{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:86c861a8-5bce-55c1-9de1-42d91f4c02c2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1", "version": "4.3.20.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.20.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b2d260a5-1fa1-5d3a-a5c3-746e44607067", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target version 4.3.20.RELEASE is NOT AFFECTED by CVE-2014-0054. The XXE vulnerability fix was already present in the upstream Spring Framework 4.3.20.RELEASE when TuxCare onboarded it. The fix commit edba32b309 (authored by upstream developer rstoyanchev@gopivotal.com) adds comprehensive defenses: processExternalEntities flag (default false), SAX feature external-general-entities disabled, StAX...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:36467301-27dc-5335-82c7-b3e10c1f6fb6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via unprotected DTD entity resolution) is NOT present in Spring Framework 4.3.20.RELEASE. The upstream fix by Rossen Stoyanchev (commit 8e096aee, May 2014) was already included in the 4.3.20.RELEASE when TuxCare onboarded it. All affected XML parsers (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter) contain the defense: external entity processing disabled by default (processExternalEntities=false) and NO_OP entity resolvers installed that return empty content instead of resolving DTD URIs.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2254ffed-0595-5413-8b3b-d8322ff24a7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 4.3.20.RELEASE. The vulnerability was an XSS issue where unencoded request URIs could inject malicious HTML/script via the form's default action attribute. The fix (commit 741b4b229a) adds URL path encoding via UriUtils.encodePath() at line 468 of FormTag.java. This fix was authored by the upstream Spring team (rstoyanchev@gopivotal.com) and ship...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:79c8bd75-f5df-5557-a2af-00007e526d42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 4.3.20.RELEASE. The upstream vendor fix (commit 9cef8e3001 by Rossen Stoyanchev) was already included in the 4.3.20.RELEASE that TuxCare onboarded. All defensive mechanisms are present and active: processPath() sanitizes paths, isInvalidPath() rejects traversal patterns, isInvalidEncodedPath() validates URL-decod...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0fdb99e3-a463-5c50-a840-d6f447ea00ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 4.3.20.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9220f527-6e91-5c69-9b38-aa15bf50f5fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.20.RELEASE does not contain the CVE-2020-5397 vulnerability. The vulnerable pattern (preflight detection without Origin header check) was introduced in Spring 5.2.x refactoring and never existed in the 4.3.x lineage. Version 4.3.20 already implements the correct behavior: CorsUtils.isPreFlightRequest() requires the Origin header via isCorsRequest() check, and DefaultCorsPro...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:10aa5b84-4499-5d64-9b0a-dafd33f38454", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c8925551-ea17-5cab-b170-40ff0e8be9b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7690bce8-b87e-5c84-82a5-465720df54ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:911e479f-8b10-51d5-8c72-32ebce9e9f97", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.20.RELEASE-tuxcare.2 is NOT AFFECTED by CVE-2023-34053. The vulnerability requires the observation/micrometer infrastructure introduced in Spring Framework 6.0, which does not exist in version 4.3.20. The CVE explicitly affects versions 6.0.0-6.0.13. While the target processes HTTP requests with custom method names, no code path exists to create unbounded KeyValue allocatio...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a52ccf9-903c-5616-96b3-2428a969cc6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d1151f1a-ecf4-5ad5-8eca-1c5689325a2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:84c37d98-572b-5f57-94e3-6400f8acaf68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.20.RELEASE-tuxcare.3." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d7a9cfd7-290b-5ba7-ac40-d668bd9a1cab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d827c3b0-4e34-5f10-b505-f5fcef1717c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eec92356-ea11-5746-88e8-fa11f8ad5700", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.20.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ba793be5-a2de-5650-ae2d-070a8c0e69fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcfb184d-22fc-5ea1-a03a-a906c53a7318", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5a413b1d-7d5f-5baa-8ef8-ec0c1fdfb0ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.20.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0bd2690d-7802-594d-896c-72cd30ddb048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b59878a6-5b2c-5613-b58c-7f6d8711c81c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a2fbc8d2-2d0b-54b8-ab45-863cc1a1c40d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f5c89103-2932-549c-adae-50f65b6f15ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9310bf1a-ab88-5a2e-afd9-97936c5fbb15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8ff19067-bbf8-5b62-bdb4-9748dc621296", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.20.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:be5cef1c-c2d3-56fe-b4bc-0ca3f0eebb5d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.20.RELEASE is not affected by CVE-2026-47883. The vulnerable component, UrlHandlerFilter, was introduced in Spring Framework 6.2.x in May 2024, approximately 6 years after the 4.3.20 release (2018). Grep search confirms no UrlHandlerFilter exists in the target repository at the analyzed commit (f127cc5ac9e0d1264b17db28f25b747858c23d50). Git history shows TuxCare correctly b...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fcaafd7a-d09f-59bd-8428-a17968617d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5587a41f-cd7c-52c6-8f3a-e14807688850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ceb10f3-d700-5765-8068-8496ba4b468d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.20.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:60d820a3-01da-5a46-95e3-705d6062a4f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.20.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks Spring MVC\u2019s functional web framework, including RouterFunction, ServerResponse.sse(), and SseServerResponse. The existing SSE implementation uses the annotation API and extends ResponseBodyEmitter (spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java:39); its String data handling prefixes lines separated by CR, LF, or CRLF (spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java:241).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.20.RELEASE-tuxcare.1" } ] }