{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:92d70226-049d-5341-ba05-7643ab8db0fa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5", "version": "4.0.0.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "4.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:42612cc5-2025-5e51-904e-4fb7256c25cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0054 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:67be3fe3-2750-51d4-b8d0-728e5507322e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-0225 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:48cd9de7-758f-50b5-96d2-e00d54956376", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-1904 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2ae34fcd-86d3-585e-8a52-671a1674cef6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3625 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6efd3c06-d479-5a41-8753-73a87c5d9608", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b75bfb26-94e1-5b23-966d-54e51e91bcf6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE does not have CORS (Cross-Origin Resource Sharing) support, which was introduced in later versions (4.2+). The vulnerability CVE-2020-5397 affects the CORS preflight request handling in Spring Framework 5.2.x, specifically the isPreFlightRequest() method in CorsUtils that failed to validate the Origin header. Since Spring Framework 4.0.0 has no CORS implementation...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e0aadb2e-f28d-52fa-a8bc-727cb79414cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:69efafd9-9425-5801-9ea6-d6edd73b9e2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:647fcedb-8402-5393-93f9-8f7b2cedf00a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:754c641e-4dd9-5999-80e7-d9b661b30e51", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE does not contain the vulnerable code. CVE-2023-34053 affects the observation infrastructure (DefaultServerRequestObservationConvention) that was introduced in Spring Framework 6.0. Version 4.0.0, released in 2013, predates the Micrometer Observation API integration by many years and lacks the entire observation package, micrometer dependencies, and ObservationRegi...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b3ea2c2d-45b3-5396-aecb-48da1bd28782", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5ae9de97-618a-5f9e-970c-c3b7a7c6bdbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:535175cb-3734-5e2a-adbb-ac6270746f57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4a112ad4-eda6-58ab-8b9f-abac5753e64a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f24e9d22-7f77-5c3d-8613-322c7b79e9df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Server-sent event support was introduced in Spring Framework 4.2.0; 4.0.0.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b8847021-7e4d-5a67-a7cd-c2187cedb101", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Script template views were introduced in Spring Framework 4.2.0; 4.0.0.RELEASE does not contain the vulnerable component.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7a30d2f9-825e-5ddf-9e6e-06a786838bc2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 The target version (4.0.0.RELEASE) is not affected by CVE-2026-22741. The vulnerability requires CachingResourceResolver and the ResourceResolver chain infrastructure, which were introduced in Spring Framework 4.1. Version 4.0.0 uses a fundamentally different architecture (ResourceHttpRequestHandler) that resolves resources fresh on each request without server-side caching, making cache poisoni...", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1ead156a-8dc0-5c86-a91a-3fd6b87eb34f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3b5bb982-c12a-5e99-97c7-6d66e6419c80", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE-tuxcare.3 is not affected by CVE-2026-41841. The vulnerability requires the CachingResourceResolver class and ResourceResolver chain infrastructure, which were introduced in Spring Framework 4.1 (April 2014). The target version 4.0.0 (December 2013) predates these components and uses a simpler ResourceHttpRequestHandler that performs deterministic resource lookups...", "justification": "code_not_present" } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5e2cdb9d-2a51-57c2-be60-261b1f73334d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2026-41842. The resource versioning feature with content-based version strategies that contains the vulnerability does not exist in this version. The vulnerability requires the presence of VersionResourceResolver and version strategy classes (AbstractVersionStrategy, AbstractFileNameVersionStrategy) which were introduced in Spring Framework ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1dd7215c-f541-5788-a875-aacba0da4978", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2026-41843. The versioned static resource resolution feature that contains the vulnerability was introduced in Spring Framework 4.1.0.RC1 (June 2014). The target repository version 4.0.0.RELEASE predates this feature, and the affected classes (AbstractVersionStrategy, AbstractFileNameVersionStrategy, VersionResourceResolver) do not exist in ...", "justification": "code_not_present" } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:11474f43-d34f-580e-aa70-67d4b3765892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3d20d763-6ca8-5775-8074-2222bf34df25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a8b6b9be-0cf7-511c-a4a3-1fb4eae4695c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:672ffa1b-3a79-592e-a34e-1d1a70ae3b11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE is NOT affected by CVE-2026-41853 (Multipart request smuggling). The target version lacks the WebFlux reactive multipart parsing infrastructure where this vulnerability manifests. The CVE affects Spring MVC **and** WebFlux in versions 5.3.0+, but 4.0.0 predates WebFlux (introduced in Spring 5.0) and uses fundamentally different servlet-based multipart handling.", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f013714d-877e-55b1-b326-11312a333055", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2 (May 2024), approximately 10 years after 4.0.0.RELEASE (2013-2014). No other component in 4.0.0.RELEASE creates automatic URI-based redirects that could exhibit the same open redirect vulnerability v...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dd43762f-e964-5e6f-8258-fff453836104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c54aa84c-51f4-5141-994b-3852e83c1950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:fcddc11b-177c-5b4d-82c6-db5b471cd268", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.0.0.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2eab9b3c-2513-5d59-ad8c-33755a3f6e82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.0.0.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.0.0.RELEASE is not affected by CVE-2026-59313 because it does not contain any Server-Sent Events (SSE) support. SSE functionality was first introduced in Spring Framework 4.2.0 (January 2015), approximately 14 months after the 4.0.0.RELEASE (December 2013). The CVE specifically requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) or SSE emitte...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.0.0.RELEASE-tuxcare.5" } ] }