{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bebc5ce9-609a-5534-9816-d058758a83ed", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8", "version": "6.2.15-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.15", "type": "library", "group": "org.springframework", "version": "6.2.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:48938a04-6312-5758-af8e-7e34cd3b11dc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6429 is an XXE vulnerability in Spring Framework's SourceHttpMessageConverter that allowed external entity resolution. The target Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED because the upstream fix (commit 2ae6a6a341 by Rossen Stoyanchev from 2013) was already present in the Spring Framework 6.2.15 release that TuxCare onboarded. The fix disables external entity processing by de...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:d754eb78-b61b-54fd-84cf-34823a73b491", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 The target (Spring Framework 6.2.15-tuxcare.8) is NOT affected by CVE-2013-6430. The vulnerability required proper escaping of four special characters ('<', '>', '\\u2028', '\\u2029') in JavaScriptUtils.javaScriptEscape() to prevent XSS attacks. The complete fix is present at JavaScriptUtils.java:78-91, where all four characters are escaped to Unicode sequences (\\u003C, \\u003E, \\u2028, \\u2029). T...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:e6f2f381-8eb1-53cf-b303-9d67a4449d57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.15-tuxcare.8 is NOT affected by CVE-2015-3192. The vulnerability affects versions before 3.2.14 and 4.x before 4.1.7. The upstream fix was applied by Rossen Stoyanchev (Spring team) on June 30, 2015 in commit d79ec68db4, which disables DTD parsing by default to prevent XML entity expansion attacks. This fix is present in the target as part of the upstream Spring ...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:e7015ff7-3b90-5686-a090-61707b019822", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. CVE-2016-1000027 affects Spring Framework's HttpInvoker deserialization classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, SimpleHttpInvokerServiceExporter) which allow remote code execution when exposed to untrusted clients. The target version 6.2.15-tuxcare.8 is NOT AFFECTED because these vulnerable classes were completely removed by the upstream Spring Framework team in version 6.0.0 (commit 5822f1bf8, Sep 2021). The entire org.springframework.remoting.httpinvoker package (79 files, 11,653 lines) was deleted as part of dropping RPC-style remoting support. TuxCare onboarded version 6.2.15 from an upstream release that already lacked these classes. The fix is an upstream vendor fix, not a TuxCare backport.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:c49e98f9-f720-5965-9e9f-1ea405beeccb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2018-11039 is not present in Spring Framework 6.2.15. The vulnerability allowed HiddenHttpMethodFilter to accept any HTTP method including TRACE via the _method parameter, enabling XST attacks. The target contains the upstream fix (commit f64fa3dea10af125d612d3a997aece93d21bc875 by bclozel@pivotal.io) that restricts allowed methods to PUT, DELETE, and PATCH only. This fix was already presen...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:7d410180-618b-5a3b-b15b-18138a15e2e3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. Spring Framework 6.2.15-tuxcare.8 is NOT affected by CVE-2021-22118. The vulnerability (predictable temporary storage directory for multipart uploads allowing privilege escalation) was fixed in the upstream release before TuxCare onboarded this version. The fix (using Files.createTempDirectory() to create random unique temp directories) is present in the codebase at FileStorage.java:119. The vulnerable pattern (fixed directory paths like /tmp/spring-multipart) is absent. Fix commits 0d0d75e253 and cce60c479c (May 2021, authored by apoutsma@pivotal.io) are ancestors of the TuxCare onboarding commit 530f923fc0 (July 2026), confirming the fix shipped with the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:e8011392-5058-59c7-8f00-3025e28d113b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. CVE-2024-22243 affects Spring Framework's UriComponentsBuilder URL parsing when `[` characters in userinfo cause host misidentification. Target version 6.2.15-tuxcare.8 underwent complete parser refactoring (commit 6c62965cbb, Oct 4 2024) replacing regex-based parsing with RfcUriParser state-machine. The new parser strictly enforces RFC 3986: when `[` appears after initial authority characters (e.g., \"user[evil.com]\"), it calls verify(false, ...) at RfcUriParser.java:214, throwing InvalidUrlException \"Bad authority\". This rejects malicious URLs like `http://user[evil.com]@victim.com/` before host extraction, preventing the attack. While the upstream fix (commit 120ea0a51c, Feb 2024) made the regex parser lenient by allowing `[`, the architectural refactoring introduced a different defense: strict validation that rejects malformed input entirely. Both approaches prevent the vulnerability\u2014lenient correct parsing vs strict rejection\u2014making the target not affected through runtime protection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "protected_at_runtime" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:21b6dcf2-5e6c-5c03-aa6a-4a295a8aa23c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. Spring Framework 6.2.15 is not affected by CVE-2024-22259. The target uses a completely different URI parsing architecture (RfcUriParser/WhatWgUrlParser) introduced in version 6.2.0 that replaced the vulnerable regex-based parsing from versions 5.x and earlier. The vulnerable code patterns (USERINFO_PATTERN and HOST_IPV4_PATTERN) that the CVE patches modify do NOT exist in version 6.2.15. The new parsers implement equivalent protections by design: RfcUriParser validates IPv6 bracket matching via state machine (lines 264-266), and WhatWgUrlParser explicitly validates unclosed brackets (lines 2096-2098). No TuxCare backport was needed because the vulnerable code was never present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:fd85a392-3387-5a83-a9a5-eeedb8fbd494", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. Spring Framework 6.2.15 is NOT affected by CVE-2024-22262. The target uses RfcUriParser (state machine with strict RFC 3986 character validation) instead of the vulnerable regex-based parsing. RfcUriParser rejects backslash characters in URI authority components via isUnreservedOrSubDelimiter() check, throwing InvalidUrlException before any host misinterpretation can occur. The vulnerable code path (regex patterns that accepted backslashes) was removed in upstream commit 6c62965cbb (Oct 4, 2024). Version 6.2.15 inherits this architectural protection from upstream Spring Framework 6.2.x.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:4a301f2e-43fe-5fca-9b64-1244e600955e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework's ETag parsing in If-Match/If-None-Match headers, causing DoS through inefficient regex processing. The vulnerability is NOT present in target version 6.2.15-tuxcare.8 because the upstream fix (commit bb17ad8314) was already included in the Spring Framework 6.2.15 release that TuxCare onboarded. The vulnerable regex-based parser has been replaced with an ...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:cc4ca154-761b-56e9-9602-0bad428b8fad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-4gc7-5j7h-4qph (affected below 6.1.14), NVD (affected below 6.1.14), CVE record (affected below 6.1.14), Snyk (affected below 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:33cb1476-0f81-52a7-b7e0-d1f2ee3bb263", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Target Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED by CVE-2025-41234 (RFD via Content-Disposition). The vulnerability fix (encoding double-quote character in filenames) is already present at ContentDisposition.java:71. This fix was introduced by upstream commit f0e7b42704e6b (author: Brian Clozel, Broadcom) and shipped in the upstream Spring Framework 6.2.15 release before TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:7d82514e-29a1-5fd0-bcb4-cc1e5e8011fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:2f184f0d-0f4f-589c-a0d8-54df3bc277cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:639ee663-8a5b-5204-8a3a-2a87f4d11af4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:747d4d66-2482-5588-bd6a-0e8013a05efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:db6d2204-b62b-508e-9d22-9112e983c483", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:465d3df2-e5aa-572a-bb05-cfccab1d76a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.15-tuxcare.8" } ] }