{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2d35140d-a481-5409-aad6-cb038191b090", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2", "version": "6.1.18-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.18", "type": "library", "group": "org.springframework", "version": "6.1.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:0c2b37b0-2e5e-5d31-91a5-9d5957e3110e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 (XXE in SourceHttpMessageConverter) is NOT present in Spring Framework 6.1.18-tuxcare.2. The vulnerability was fixed by upstream Spring in commit 2ae6a6a3415eebc57babcb9d3e5505887eda6d8a (authored by rstoyanchev@gopivotal.com) which shipped in Spring Framework 6.1.18 before TuxCare onboarding. The target code has comprehensive XXE protections: processExternalEntities defaults to f...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:39553d2b-03b4-56a5-9a6b-96aa9bda2831", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in Spring Framework 6.1.18-tuxcare.2. The JavaScriptUtils.javaScriptEscape() method contains proper escaping for all four vulnerable characters: left/right angle brackets (<, >) and Unicode line/paragraph separators (\\u2028, \\u2029). The fix was authored by upstream Spring (rstoyanchev@vmware.com) in commit f5c9fe69a and shipped in the upstream 6.1.18 release that T...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:92d063d4-ea18-520b-9575-75278eeefd9f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7, which allowed DoS via inline DTD declarations. The target version 6.1.18 is not affected because the upstream Spring Framework already included the fix (disabling DTD processing by default) in this release. The fix was originally applied by upstream engineer Rossen Stoyanchev in 2015 (commit d79ec68db4) and prop...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:b8c74fff-0007-5e84-a19f-f7ece46d1cc8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.1.18 is NOT affected by CVE-2016-1000027. The vulnerable HttpInvoker remoting classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) were completely removed by upstream Spring Framework in version 6.0.0. The target version 6.1.18 never contained these classes - they were already absent when TuxCare onboarded this version. The entire org.springframework.remoting.httpinvoker package does not exist in the codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:36a38df3-815e-576b-be37-0c188067bcf3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.1.18-tuxcare.2 is NOT affected by CVE-2018-11039. The vulnerability (unrestricted HTTP method override via HiddenHttpMethodFilter) was fixed in the upstream Spring Framework release that TuxCare onboarded. The fix restricts allowed HTTP methods to PUT, DELETE, and PATCH only, preventing TRACE and other disallowed methods from being set via the _method parameter.", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:5dba9a47-a73e-5a01-88d9-afda9bca382d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. The target Spring Framework 6.1.18-tuxcare.2 is not affected by CVE-2021-22118. The vulnerability involves predictable temporary directory paths for multipart file uploads, allowing local attackers to read/modify uploaded files or overwrite arbitrary files. The fix (commit 0d0d75e253) was already present in the upstream 6.1.18 release before TuxCare onboarding. The target uses FileStorage.tempDirectory() which creates random temporary directories via Files.createTempDirectory(\"spring-multipart-\"), preventing the predictable path exploitation. The fix was authored by upstream developer apoutsma@pivotal.io and shipped in the original upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:deb4abfe-3847-560e-abe6-dabb80fb1825", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. CVE-2024-22243 affects Spring Framework's UriComponentsBuilder when parsing URLs with '[' characters in userinfo, potentially enabling host validation bypass. The vulnerability was fixed in upstream commit 120ea0a51c (Feb 9, 2024) by changing USERINFO_PATTERN from ([^@\\\\[/?#]*) to ([^@/?#]*), removing the '[' exclusion. The target (version 6.1.18-tuxcare.2) has pattern ([^/?#\\\\\\\\]*) which also allows '[' in userinfo. The fix was already present in the upstream release that TuxCare onboarded on Sep 16, 2026. No vulnerable code paths exist in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:f61a11cb-dcf6-5f2a-9e27-f16a22bffb93", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. The target repository (Spring Framework 6.1.18-tuxcare.2) is not affected by CVE-2024-22259. The vulnerability fix was included in the upstream Spring Framework 6.1.18 release before TuxCare onboarded it. The fix (commit 381f790329a48b74c2a49fc1384dd68ca9153501, authored by rossen.stoyanchev@broadcom.com on March 5, 2024) modifies URL parsing regex patterns and adds validation to prevent open redirect/SSRF attacks through malformed URLs containing special characters like @ and [ that could cause host validation bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:0a671381-64a8-568e-9f5c-b158f5756c63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. CVE-2024-22262 affects applications using UriComponentsBuilder to parse externally provided URLs with validation checks on the host, enabling open redirect or SSRF attacks via backslash characters in URI components. The vulnerability arises from regex patterns that fail to reject backslashes in scheme, userinfo, host, and port components, allowing attackers to bypass host validation.\n\nTarget spring-framework 6.1.18-tuxcare.2 is NOT AFFECTED. The fix was already present in the upstream Spring Framework 6.1.6 release (April 2024) by Brian Clozel, which added backslash (`\\\\`) to negated character classes in all four vulnerable regex patterns. Version 6.1.18 inherited this fix naturally from upstream. TuxCare's onboarding of 6.1.18 included the already-fixed code, so no additional backport was necessary.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:8d2e7348-738a-5361-92cc-0e04bd286c85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework's ETag parsing in If-Match/If-None-Match headers, where regex-based parsing could cause DoS via catastrophic backtracking. The target version 6.1.18 already contains the upstream fix (commit bb17ad8314) that replaced regex parsing with an efficient state-machine parser. The vulnerable ETAG_HEADER_VALUE_PATTERN regex does not exist in the codebase. The fix...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3ff21b-aa31-572a-b1f9-7bc285d3b345", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. The upstream fix was released in 6.1.14, and version 6.1.18 is a later release of the same line. Advisories: GitHub GHSA-4gc7-5j7h-4qph (fixed in 6.1.14), NVD (fixed in 6.1.14), CVE record (fixed in 6.1.14), Snyk (fixed in 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:e56bce4e-0da7-5699-ae43-191fb8c8e022", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:7aa6d4b8-310f-50e6-be2a-0bc5d8c45242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:0739ec7c-dedd-57d8-97c3-4c5d2579ac60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:541d8077-c6f1-515e-a2db-626e545634dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:de836821-3b86-5512-a56a-0db91ed25642", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.18-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.18 is not affected by CVE-2026-47889. The vulnerability affects only the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse), which was introduced in Spring Framework 6.2.0-M5. Version 6.1.18 uses the servlet-based Jetty EE10 adapter (ServletServerHttpResponse), which correctly handles the sameSite cookie attribute. TuxCare backported this CVE to 6.2.x versions onl...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:1f036cb0-f95c-527f-8d45-58df8cca7f7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ], "bom-ref": "urn:uuid:31b7fe81-8f91-5a93-af11-8eb58058df83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.18-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.18-tuxcare.2" } ] }