{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a0acbe8a-cf10-5e5f-b0d3-c9707ac060b0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5", "version": "3.1.1.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "3.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c28cc30e-7f61-5b18-b6ee-feb0abedb0ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0054 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:96dc1817-af11-566f-bbab-5b5315d65a57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0225 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0b92eb8d-9243-54ff-862b-8f112d6e4634", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-1904 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e9e7e4b7-108e-5a63-8fda-a788cfadc004", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3625 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:db6dcd9c-f361-5605-82b3-1ebf33ed4335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1e8c89ae-2c76-5dc2-913a-1c92f7456734", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is NOT AFFECTED by CVE-2020-5397. The vulnerability exists in CORS (Cross-Origin Resource Sharing) preflight request handling logic, which was not yet implemented in this version. CORS support was introduced in Spring Framework 4.2.0 (April-July 2015), over 3 years after the 3.1.1.RELEASE (February 2012). Without CORS functionality, the vulnerable code pattern (im...", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:90631974-7568-597b-87fb-982e683b3cd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:34d852f4-749e-564d-81b6-e68f3422a5ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f9c430f1-d0f8-55a0-81d0-d1a7a2132475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d38664e1-2162-5e63-8a3b-5631a68c84ff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2023-34053. This DoS vulnerability involves unbounded allocation of metric dimension objects when processing arbitrary HTTP method names through Spring's Micrometer observation conventions. However, the entire observation/micrometer integration feature did not exist in Spring Framework 3.1.1 (released ~2012). The vulnerability requires class...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c6b4fcad-baf5-5eff-95a8-44124dd71d8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cd1e86ec-dc44-5365-9cdf-01219cf92b26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ddb743fb-d59b-59f5-8e83-3d9d89ca69ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:edfabb92-4030-52b3-9185-d036e9eadc46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6e7e28a5-07de-517d-a42b-e727a15ee05a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:cb7c36f1-622b-5a34-a8da-88b05900528b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 3.1.1.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:38d20908-985b-5a19-a228-8e7e1922c7e1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-22741. The vulnerable component (CachingResourceResolver) and the resource chain infrastructure were not introduced until Spring Framework 4.1.0.RC1. Version 3.0.5 uses a simpler ResourceHttpRequestHandler that resolves resources on every request without application-level caching, making the cache poisoning attack described in the CVE i...", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c4ff8575-b33d-5673-8651-019b1154a818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:99bc95f8-f3d7-517c-9a30-87e4a955e2be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 does not contain the vulnerable CachingResourceResolver class or any server-side caching mechanism for static resource resolution. The vulnerability (CVE-2026-41841) is specific to the caching resolver feature introduced in Spring 4.1.0, approximately 2-3 years after this version was released.", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:32487928-cf29-5191-a52e-c7be1859009a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is NOT affected by CVE-2026-41842. The vulnerability exists in content-based version strategies for static resource handling, a feature introduced in Spring Framework 4.1 (2014). Spring 3.1.1 (2011) predates this feature and contains no version removal logic in resource handling.", "justification": "code_not_present" } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7e8ec33b-bec1-5481-8349-dee950769964", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-41843. The vulnerability requires the content-based version strategy feature (VersionResourceResolver, AbstractVersionStrategy, etc.) which was introduced in Spring Framework 4.1+. This feature does not exist in version 3.1.1, making the attack chain impossible.", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:62d8715f-738c-54e3-9aa3-f80c2a06077f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7dd886e4-95d2-5f02-9983-825887ba7966", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41845 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE (2012) predates the ECMAScript 6 specification (2015) that introduced template literal syntax. While the code lacks escaping for backtick (`) and dollar sign ($) characters in JavaScriptUtils.javaScriptEscape(), these unescaped characters cannot lead to arbitrary JavaScript code execution in the pre-ES6 JavaScript environment this version was designed for. The att...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4f176063-0428-534f-84a6-7168beb22304", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bcfa2773-7155-5f75-8ecf-c1e63aa3503f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41853. This version predates the affected version range (5.3.0+) and lacks the vulnerable components. Spring 3.1.1 does not implement custom multipart boundary parsing; it delegates all multipart parsing to external libraries (Apache Commons FileUpload or Servlet 3.0 Part API). The CVE specifically mentions 'Spring MVC and WebFlux' - WebFlux wa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5461769b-4e88-5e3d-a7ba-dc0d63c03af3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2+, approximately 10+ years after version 3.1.1.RELEASE (2012). The target repository contains no references to UrlHandlerFilter, and TuxCare has only backported fixes for this CVE to 6.2.x branches wh...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1e8cb885-5dd0-5e1b-96fa-0218c37bfe6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:90402de1-004a-5f8c-ab1f-aea241b50574", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:df6607ea-1ab1-5f4d-9b8e-ccda9aa0c587", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 3.1.1.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:83ca5dd4-aeb9-51f1-9459-682c93c1bb59", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 3.1.1.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 3.1.1.RELEASE is not affected by CVE-2026-59313. This vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) for Server-Sent Events, which was introduced in Spring 5.0 (2017). The target version 3.1.1.RELEASE (2012) predates this feature by 5 years and contains no SSE-related code. The SSE support itself (SseEmitter) was first introd...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@3.1.1.RELEASE-tuxcare.5" } ] }