{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:785157eb-4aba-5167-8773-2a49ddf857da", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16", "version": "6.1.21-tuxcare.16", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.21", "type": "library", "group": "org.springframework", "version": "6.1.21" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:cde7febd-b9fb-5826-8fa1-eae95cfaa583", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework version 6.1.21-tuxcare.16 is NOT affected by CVE-2013-6429 (XXE in SourceHttpMessageConverter). The upstream vendor fix disabling external entity resolution was already present in the Spring Framework release that TuxCare onboarded. The vulnerable code pattern (XML parsers processing external entities by default) does not exist in the target - all three parser types ...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:a9b95299-d040-513a-b563-00e88e23479b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430: The target repository (Spring Framework 6.1.21-tuxcare.16) is NOT AFFECTED. The vulnerability involved missing character escaping in JavaScriptUtils.javaScriptEscape() for four specific characters: Unicode line separator (U+2028), paragraph separator (U+2029), left angle bracket (<), and right angle bracket (>). These characters could break out of JavaScript string contexts or in...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:14e21f3b-54d7-54e2-831e-b834339c753d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 describes a DoS vulnerability through XML DTD processing causing memory exhaustion. The upstream Spring Framework fix (commit d79ec68db4) was already present in the upstream release that TuxCare onboarded. The target at version 6.1.21-tuxcare.16 contains the complete fix: DTD processing is disabled by default via the supportDtd flag (defaults to false) across all XML unmarshalling...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:309cf7ae-cef4-5dd1-9e12-08f72dd277c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. Spring Framework 6.1.21 is not affected by CVE-2016-1000027. The vulnerable HTTP Invoker classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter, and the entire org.springframework.remoting package) were completely removed from Spring Framework in version 6.0.0 by upstream commit 5822f1bf85 \"Drop RPC-style remoting\". The target version 6.1.21-tuxcare.16 inherits this removal from the upstream 6.1.21 release, making the deserialization vulnerability code path non-existent.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:8ae74cf1-c44a-5761-9626-f30418dfcdad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is NOT present in Spring Framework 6.1.21-tuxcare.16. The vulnerability allowed unrestricted HTTP method override via HiddenHttpMethodFilter, enabling XST attacks. The upstream Spring team fixed this in May 2018 by restricting allowed methods to PUT, DELETE, and PATCH only. This fix was already present in the upstream 6.1.21 release that TuxCare onboarded. Both servlet and reacti...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:665119ff-2b4a-5554-95d6-ee2731515db9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. CVE-2021-22118 affects Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. The target is version 6.1.21-tuxcare.16, which shipped with the upstream fix already applied. The vulnerability involved predictable temporary directory paths for multipart file uploads (e.g., fixed path `Paths.get(System.getProperty(\"java.io.tmpdir\"), \"spring-multipart\")`), allowing local attackers to manipulate uploaded files. The fix replaced predictable paths with randomly-generated temporary directories via `Files.createTempDirectory()`. This fix is present in the target: FileStorage.java:119 uses `Files.createTempDirectory(IDENTIFIER)` and DefaultPartHttpMessageReader.java:72 uses `FileStorage.tempDirectory()`. The vulnerable pattern is completely absent. The fix was authored by apoutsma@pivotal.io and shipped in the upstream release before TuxCare onboarding (commit d48bec5394 by evasilev@cloudlinux.com).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:48d4d5db-3b98-5c9d-a79d-a618b29c0c0f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. CVE-2024-22243 affects UriComponentsBuilder's URL parsing, where the USERINFO_PATTERN regex excluded `[` characters, causing host parsing confusion that could bypass validation. The upstream fix (commit 120ea0a51c by rossen.stoyanchev@broadcom.com, Feb 2024) removed `\\\\[` from the exclusion list, allowing `[` in userinfo. This fix was included in Spring Framework v6.1.4 and is present in all subsequent releases including v6.1.21. The target (6.1.21-tuxcare.16) is based on upstream v6.1.21 which already contained the fix. Current code at line 80 shows USERINFO_PATTERN = \"([^/?#\\\\\\\\]*)\" which does NOT exclude `[`, confirming the vulnerability pattern is absent. A subsequent refinement (494ed4e852, Apr 2024) further modified the pattern but maintained the CVE fix.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:2e8058e7-d6af-55c9-9840-815da604b757", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. CVE-2024-22259 fix was already present in upstream Spring Framework 6.1.21 when TuxCare onboarded it on Oct 6, 2025. The vulnerability pattern (missing IPv6 bracket validation and flawed regex patterns allowing host misparsing) is not present in the target. The checkSchemeAndHost method correctly validates IPv6 brackets and the regex patterns correctly handle special characters, preventing open redirect/SSRF attacks via malformed host parsing.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:24ad6055-65e3-591d-8ae0-cbf232c989dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. The target Spring Framework 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-22262. The vulnerability involved UriComponentsBuilder accepting backslash characters in URL structural components (scheme, userinfo, host, port), allowing attackers to craft malicious URLs that bypass host validation checks, leading to open redirect or SSRF attacks. However, the fix (excluding backslashes from these components via regex pattern updates) was already present in the upstream Spring Framework 6.1.21 release that TuxCare onboarded. The fix was introduced by upstream commit 494ed4e852e authored by brian.clozel@broadcom.com on 2024-04-11, which predates the first TuxCare commit (d48bec5394b) in this repository's history. All four affected patterns (SCHEME_PATTERN, USERINFO_PATTERN, HOST_IPV4_PATTERN, PORT_PATTERN) contain the backslash exclusion \\\\\\ in the current code at lines 76, 80, 82, and 88 of UriComponentsBuilder.java.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:dfd5313e-7954-5677-8eb5-9ff823a4b4c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 Target version 6.1.21-tuxcare.16 is NOT AFFECTED by CVE-2024-38809. The vulnerability was a ReDoS (Regular Expression Denial of Service) in ETag header parsing using a catastrophic backtracking regex pattern. This was fixed in upstream Spring Framework 6.1.12 (CVE affected 6.1.0-6.1.11). The target is based on upstream 6.1.21, which already contains the fix (commit bb17ad8314 by rossen.stoyanch...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:c7094b9f-84c5-5214-836b-9bf2013cbd27", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38820 (locale-dependent toLowerCase bypassing disallowedFields) is NOT present in Spring Framework 6.1.21. The upstream vendor fixed the vulnerability in commit 23656aebc6 (Oct 2024) by using toLowerCase(Locale.ROOT), then refactored to simpleMatchIgnoreCase in commit edfcc6ffb1 (May 2025). Both commits shipped in the upstream 6.1.21 release. The refactored code uses equalsIgnoreCase()...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:3e784496-1fc4-5f15-b5d5-b85b33096179", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 CVE-2025-41234 (Reflected File Download via unencoded double-quote in Content-Disposition header) is NOT present in Spring Framework 6.1.21-tuxcare.16. The fix (PRINTABLE.set(34, false) at line 70 of ContentDisposition.java) was already included in upstream Spring Framework 6.1.21 release (commit fd68ea6fcbf by brian.clozel@broadcom.com, dated 2025-06-12) before TuxCare onboarded this version. ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:ff66dd16-b6a3-53d4-b67f-69b201623696", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:3cfaf728-e25d-5244-83fb-8b81840050c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:6c558e3b-0562-5d70-b5f2-9710bb6a4135", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:1a31881d-8101-5251-9d84-404b176ca642", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.21-tuxcare.16 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.21 is not affected by CVE-2026-47889. The vulnerable component JettyCoreServerHttpResponse was introduced in version 6.2.0 and does not exist in 6.1.21. Version 6.1.21 uses ServletServerHttpResponse for Jetty support via the EE10 Servlet API, which properly serializes response cookie sameSite attributes. The CVE specifically affects \"Jetty 12 Core reactive adapter\" - a feat...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:3c43c788-ac08-5ed9-9281-18d04b7579ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ], "bom-ref": "urn:uuid:908be2da-4ff4-5500-8cb5-7e08982fbd74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.21-tuxcare.16 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.21-tuxcare.16" } ] }