{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:deafb3b7-495f-50ad-a452-118581eea803", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6", "version": "6.2.5-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.5", "type": "library", "group": "org.springframework", "version": "6.2.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:5bc44f0b-b947-5857-876a-27c520b465be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.5 is NOT affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed by upstream vendor (Rossen Stoyanchev from Pivotal) in commit 2ae6a6a341 dated Nov 5, 2013, which shipped in the upstream 6.2.5 release before TuxCare onboarding. The fix disables external entity processing by default via XML parser security features and NO_OP entity...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:313597c0-05c6-5a74-8e0c-61da986d407d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 6.2.5. The vulnerability concerns missing character escaping in JavaScriptUtils.javaScriptEscape() for '<', '>', Unicode line separator (\\u2028), and paragraph separator (\\u2029). The target repository contains the complete fix at spring-web/src/main/java/org/springframework/web/util/JavaScriptUtils.java lines 78-91, which properly escapes all fo...", "justification": "code_not_present" } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:1ec09074-c668-51ae-978b-b8436aadca35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2015-3192. The upstream vendor fix that disables DTD processing by default (commit d79ec68d by Rossen Stoyanchev, June 2015) was already present in the Spring Framework 6.2.5 release that TuxCare onboarded. All XML processing classes (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter) have supportDtd=false by default and set the XML pa...", "justification": "code_not_present" } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:50cf4b05-6c6a-592e-a2a3-507805c5c7f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. Target Spring Framework 6.2.5 is NOT affected by CVE-2016-1000027. The vulnerable HTTP invoker deserialization classes (HttpInvokerServiceExporter, HttpInvokerProxyFactoryBean, and related RPC-style remoting infrastructure) were completely removed from Spring Framework in version 6.0.0 (upstream commit 5822f1bf85, 2021-09-17). The removal was performed by the upstream maintainer Juergen Hoeller prior to TuxCare's onboarding of version 6.2.5. The target does not contain any HTTP-based Java object deserialization endpoints. All serialization in the current codebase uses safe formats (JSON, CBOR, Protobuf) via Kotlin serialization libraries, not unsafe Java ObjectInputStream deserialization over HTTP.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 6.0.0), NVD (< 6.0.0), Snyk (<= 0).", "justification": "code_not_present" } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:1407433b-75fe-5e10-ad69-4840e7e0b9a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11039 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2018-11039. The vulnerability (allowing arbitrary HTTP method override including TRACE via HiddenHttpMethodFilter) was fixed by upstream Spring developers in May 2018. Both servlet and reactive HiddenHttpMethodFilter variants contain the ALLOWED_METHODS whitelist restricting method override to only PUT, DELETE, and PATCH. This fix was already includ...", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:1a4f0fd6-eb47-5aeb-900e-045fc79d0881", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. The target Spring Framework 6.2.5-tuxcare.4 is NOT affected by CVE-2021-22118. The vulnerability pattern (predictable temporary storage directory paths in multipart file upload handling) was fixed in the upstream Spring Framework release prior to version 6.2.5. The fix was introduced in upstream commit 0d0d75e25322d8161002d861fff3ec04ba8be5ac by Arjen Poutsma, which replaced predictable directory paths with random temporary directories using Files.createTempDirectory(). This commit is an ancestor of HEAD and predates TuxCare's onboarding of version 6.2.5, confirming the fix shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), NVD (>= 5.2.0, < 5.2.15; >= 5.3.0, < 5.3.7), cve.org (>= 5.2, < 5.2.15; >= 5.3, < 5.3.7), Snyk (>= 5.3.0, < 5.3.7; >= 5.0.0.RELEASE, < 5.2.15.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:b13216ec-f0a0-5347-b411-2d4091a1eb10", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.2.5 is not affected by CVE-2024-22243. The vulnerability involved incorrect URL parsing due to a regex pattern (USERINFO_PATTERN) that excluded square brackets from userinfo, causing host confusion in validation bypass attacks. The fix (commit 120ea0a51c by upstream vendor) was already present in the upstream Spring Framework 6.2.5 release that TuxCare onboarded. Subsequently, the entire regex-based parser was replaced with state machine parsers (RfcUriParser, WhatWgUrlParser), further eliminating the vulnerability pattern. The vulnerable code is not present in HEAD.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.4; >= 6.0.0, < 6.0.17; >= 5.3.0, < 5.3.32; <= 5.2.25.RELEASE), cve.org (>= 6.0.x, < 6.0.17; >= 6.1.x, < 6.1.4; >= 5.3.x, < 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4; >= 5.3.0, < 5.3.32), Snyk (< 5.3.32; >= 6.0.0, < 6.0.17; >= 6.1.0, < 6.1.4).", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:cef0000d-ba9e-5584-a85e-171a19dc8bb3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.2.5 is not affected by CVE-2024-22259. The vulnerability targeted an older regex-based URL parser that is not present in version 6.2.5. This version uses a completely new parser architecture (RfcUriParser and WhatWgUrlParser) introduced by upstream in October 2024, which includes proper IPv6 bracket validation from its initial implementation. The fix was authored by upstream (rossen.stoyanchev@broadcom.com) and shipped in the upstream 6.2.5 release that TuxCare onboarded in March 2025.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; < 5.3.33), NVD (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5), cve.org (>= 6.1.x, < 6.1.5; >= 6.0.x, < 6.0.18; >= 5.3.x, < 5.3.33; >= 6.1.0, < 6.1.5; >= 6.0.0, < 6.0.18; >= 5.3.0, < 5.3.33), Snyk (< 5.3.33; >= 6.0.0, < 6.0.18; >= 6.1.0, < 6.1.5).", "justification": "code_not_present" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:5e7771ee-d718-5546-adf0-e33d94249bd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.2.5 is not affected by CVE-2024-22262. The vulnerable regex-based URI parsing code is absent from this version, which instead uses RfcUriParser - a state-machine parser implementing RFC 3986 compliance. RfcUriParser validates characters in authority components against RFC 3986 standards and rejects backslash characters (not in unreserved or sub-delimiter sets) with InvalidUrlException, preventing the host confusion attack described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6), cve.org (>= 6.1.x, < 6.1.6; >= 6.0.x, < 6.0.19; >= 5.3.x, < 5.3.34; >= 6.1.0, < 6.1.6; >= 6.0.0, < 6.0.19; >= 5.3.0, < 5.3.34), Snyk (< 5.3.34; >= 6.0.0, < 6.0.19; >= 6.1.0, < 6.1.6).", "justification": "code_not_present" } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:008ea44b-f7ef-57b4-a9f6-df23d8266540", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.5 is NOT AFFECTED by CVE-2024-38809 (DoS via ETag parsing). The vulnerable regex-based ETag parsing pattern was removed by upstream Spring Framework before the 6.2.5 release. The fix (commit bb17ad8314b8) introduced a bounded linear-time state machine parser that eliminates the resource exhaustion vulnerability. All affected files (ETag.java, HttpHeaders.java, ServletWebReq...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:efdbf4df-de16-52e4-ad29-24f50224e3d2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.5-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38820 vulnerability not present in Spring Framework 6.2.5. The upstream fix (commit 23656aebc6 by rossen.stoyanchev@broadcom.com) was already included in the upstream release before TuxCare onboarded version 6.2.5 on 2026-09-16. The vulnerable pattern (locale-dependent toLowerCase() without Locale.ROOT in DataBinder field matching) was never present in the TuxCare-maintained codebase. ...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:5c68fd76-3207-55c1-be81-3260c6aee862", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:3bf9699b-3cc5-5025-b0a2-061c4a5ccab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:7441e820-ae71-529e-8a72-f3407a000857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:06124eb9-5417-5c84-a5f2-12d0ab3be6e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:4bc43e23-95d4-558e-9bf5-6d43dc91788f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:b2a1d27d-2d44-57bd-b656-c3c46f4f0c76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ], "bom-ref": "urn:uuid:7698e905-6663-5e23-bc90-461fd220d475", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.5-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.5-tuxcare.6" } ] }