{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e9b98453-7ba3-5eee-9bc3-2d2a8c23df5c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1", "version": "2.5.4-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@2.5.4", "type": "library", "group": "org.springframework", "version": "2.5.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:7ca8a765-4cb8-527b-ace8-5d96eb342aa8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4. CVE-2014-0054 affects Jaxb2RootElementHttpMessageConverter, which belongs to the HttpMessageConverter infrastructure introduced in Spring 3.0. This tree has no message converters, no JAXB/OXM code and no @XmlRootElement handling, so the Brief's input never reaches an XML unmarshalling step. Same product lineage as the advisory, so not false_positive.", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:d0436df4-c7c6-5356-a4ba-43eab85fc026", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0225 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:24655026-61d7-5cf2-a9b6-87b7771b472d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-1904 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:3d19cb8f-e6ed-5435-8155-8dfc72d1c719", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: No vulnerable code from the fix was found; the classes the fix changes and their component are absent from this version. Version 2.5.4 is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-hhm4-hwq6-3c6w (newer lines only), NVD (newer lines only), Snyk (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:f5d6ea5d-960b-567f-a2b7-c09ee1c32b56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9878 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:b84f2713-6214-51e8-85d3-d53a08d67406", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target is Spring Framework 2.5.4 (TuxCare branch), the same product as the CVE but a much older line. CVE-2020-5397 concerns the CORS support added in 5.x (preflight handling in the MVC and WebFlux handler mappings). The 2.5.4 tree has no CORS code at all, so a preflight request cannot be accepted or approved by the framework. The CVE's backport commits exist only on the 5.0.19, 5.1.5 and 5...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:934baca4-9047-56f6-b5f3-7fbef9114621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:0adb80cc-852b-535e-8d7d-a437a6250b16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:147ce354-becf-58a5-92bd-03ee893e7879", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:cbcdf97f-67e1-592a-b64a-39c4282720b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 2.5.4 (TuxCare branch) has no Micrometer or Observation support, so CVE-2023-34053 does not apply. The CVE concerns Spring MVC/WebFlux 6.0.0-6.0.13 with micrometer-core and an ObservationRegistry recording HTTP observations. The target has no observation or metrics recording code to exhaust resources.", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:63d74235-6575-57d8-929e-3edf46b7a5f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:da0aed0e-a12d-5a15-a17b-96d5d2bec2a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:a7cc4f4b-96e6-5ef4-8701-27859f3bbdd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4. CVE-2024-38828 concerns the @RequestBody byte[] handler argument, which is read through ByteArrayHttpMessageConverter in the HttpMessageConverter infrastructure. Neither the annotation nor that infrastructure exists in 2.5.x (introduced in 3.0), so the vulnerable path is absent.", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:03486a18-a768-5176-8916-9863a8b640c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41242 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target is Spring Framework 2.5.4 (TuxCare ELS branch). CVE-2025-41242 affects the MVC static resource handling (ResourceHttpRequestHandler / PathResourceResolver, the mvc resources mapping). That component does not exist in 2.5.4, and I found no other chain that reaches the same goal. The only resource-serving servlet is ResourceServlet, which works differently and is not the affected compo...", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:82f6e6ed-4ff8-59ad-a845-de801eddabd8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4 (2008-era). It has no Server-Sent Events support: no SseEmitter, no ServerSentEvent, no text/event-stream handling, no WebFlux and no reactive stack. CVE-2026-22735 affects the SSE encoders in Spring MVC and WebFlux, which this version doesn't contain.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:49c551b6-39d3-5042-81fb-df1064ec2591", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4 (tuxcare-current/2.5.4). CVE-2026-22737 affects ScriptTemplateView / ScriptTemplateConfigurer (JSR-223 script-engine template views), which were introduced in Spring 4.2. They do not exist anywhere in this tree, so the vulnerable component is absent (Type A1). The only 2.5.4 code touching scripting is the bean-scripting support in spring-context (JRubyScriptFact...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e4cf7249-f884-5a84-85a4-f3c4c5939c6a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4. The static-resource resolver chain (ResourceHttpRequestHandler, CachingResourceResolver, EncodedResourceResolver, PathResourceResolver) was added in Spring 4.1 and does not exist here. No code in the repo can poison a resource cache with wrongly-encoded resources, so CVE-2026-22741 does not apply to this version.", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:ec8521b9-ca63-555f-b55f-dcdaa6e2778b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22745 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4 (pre-3.0). It has no Spring MVC static-resource handling subsystem (ResourceHttpRequestHandler/PathResourceResolver) and no WebFlux (ResourceWebHandler), which CVE-2026-22745 concerns. The only resource-serving code is ResourceServlet, which serves explicitly configured resource URLs filtered by an allowedResources pattern, not request paths resolved against fil...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:94a6f9c7-085c-58ca-a9b1-a18e26808bbc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target is Spring Framework 2.5.4. The static-resource handling the CVE concerns (ResourceHttpRequestHandler/ResourceWebHandler, resource resolver chain with a shared cache) was added in 3.0.4 and 4.1 and does not exist here. The only static-resource component, ResourceServlet, has no resolver chain, multi-location lookup or shared cache. No fixing commit applies, so the fixing_commit fields are...", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:82942a1b-0148-547f-991a-dc714379ff6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:363ff824-a4d1-513c-9e78-1f6d8668d734", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target is Spring Framework 2.5.4, which has none of the features CVE-2026-41843 needs: no static-resource handler, no resource-resolver chain, no versioned-resource support, and no WebFlux. The attacker input (a static-resource URL carrying version or hash metadata) is not received anywhere in the code, so there is no path to the goal. Type A1. The product matches the advisory (spring-frame...", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:ee0536c1-0ac0-5146-a223-185168888fb3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:313ebf1d-fdad-51c2-892c-f47a8f8413a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5db04048-1cf5-5e1d-a63e-31af225e3929", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:76cab227-8cc5-5ec9-92e4-26d5ed5cf2ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 2.5.4 contains no multipart parser of its own. It hands multipart parsing to Apache Commons FileUpload, which is an optional declared dependency and is not vendored in the repo. The CVE-2026-41853 flaw is a parsing differential in the framework's own multipart parsing code, and that code does not exist in this version. No Spring code path in the target can produce the parsing d...", "justification": "requires_dependency" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:5a9d04a8-3fa8-5175-8a03-95506851f160", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: The functions the fix changes do not exist in this version. Version 2.5.4 is on an older release line than any version the advisories list as affected. Advisories: NVD (newer lines only), CVE record (newer lines only).", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:1fbb087c-affb-5cf0-8c57-575941da75d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:0a8c6915-2ca5-5c76-b968-60c20d8951ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:95f2cfec-d1e7-56f8-8a5b-cf65d6c1cc8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47890 affects version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ], "bom-ref": "urn:uuid:e19d02a2-4779-5818-9781-0220454dcea2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 2.5.4-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target is Spring Framework 2.5.4 (modules spring-webmvc, spring-web and others). It has no functional web framework (RouterFunction, ServerResponse.sse()) and no Server-Sent Events support, so the vulnerable SSE serialization code does not exist. The repo is the same product lineage, so this is not a false_positive.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@2.5.4-tuxcare.1" } ] }