{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:4a8c086b-6918-573d-a228-48a3fdbdad0d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3", "version": "4.3.21.RELEASE-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.21.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:7d3200cf-8fa7-5d58-9569-74c8aa8cd268", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 XXE vulnerability is not present in Spring Framework 4.3.21.RELEASE. The fix was shipped in upstream Spring Framework releases 3.2.8 and 4.0.2 (February 2014), and the target version 4.3.21.RELEASE (released years later) already contains the complete XXE protection. The Jaxb2RootElementHttpMessageConverter.processSource() method wraps StreamSource with an XMLReader configured to d...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:3eb54a2a-d111-5f6f-b804-34d9f8adcf68", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. The target repository (Spring Framework 4.3.21.RELEASE) is NOT AFFECTED by CVE-2014-0225. The XXE vulnerability fix was already present in the upstream 4.3.21.RELEASE when TuxCare onboarded it. All five patched files contain the defense mechanism: NO_OP_ENTITY_RESOLVER that returns empty InputSource and NO_OP_XML_RESOLVER that returns empty input, preventing external entity resolution in DTD declarations. The defense is active by default (processExternalEntities defaults to false). Fix commit 8e096aeef5 by upstream author rstoyanchev@gopivotal.com is an ancestor of both HEAD and the first TuxCare onboarding commit (87574db4d0).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:89320a85-90ea-5a94-8fe4-85e45989d8f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 4.3.21.RELEASE. The vulnerability involves XSS via unencoded request URIs in FormTag's default action attribute. The upstream fix (commit 741b4b229a by rstoyanchev@gopivotal.com, dated 2014-02-13) that adds URI encoding via UriUtils.encodePath() was already included in the upstream release 4.3.21.RELEASE when TuxCare onboarded it. The target vers...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:88f0014e-ac7a-5a11-a9a2-fd792c5e7c42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is not present in Spring Framework 4.3.21.RELEASE. The vulnerability affects versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2. The target version 4.3.21.RELEASE already contains the upstream security fixes that were introduced in version 4.1.2, including path validation, URL decoding checks, and resource location verification to prevent direct...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:aeabf605-6d2e-551f-9b87-1dd99e6be807", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 4.3.21.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:047a0de8-3b0e-54e7-a2ad-3849766e2649", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2020-5397. The vulnerable code pattern was introduced only in Spring Framework 5.2.0 (April 2019) and does not exist in the 4.3.x line. In 4.3.21, the `isPreFlightRequest()` method already requires an Origin header (via `isCorsRequest()`), preventing the CSRF attack vector described in the CVE. The vulnerability was specific to 5.2.x versio...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8f6c78e3-bfd6-585d-99a4-f3bd4acc04bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:94819efa-1879-58c6-ab80-07698641ec3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:8392ddea-8860-5a34-a793-034a5168370e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:4e823049-b4b7-54f4-8773-9347f6a6f6c5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation framework introduced in Spring Framework 6.0.0, which creates unbounded KeyValue allocations for arbitrary HTTP method names. Version 4.3.21 predates this framework by several major versions and contains no observation, micrometer integration, or KeyValue allocation code. The entire vu...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d9c606dc-05bb-5f8f-89d2-f0649edcc064", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:039f45a8-81c7-5e01-8141-10e21e099114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:4fa2bc3a-2411-5de9-a28d-7c50e558b806", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc, and is fixed in 4.3.21.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ddc003b7-ff6c-5ea8-a84f-47ea97e2665f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:f73e0f43-4a34-5417-9a9e-79ac35ea4725", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:fac3b05d-2a10-5805-be82-43bfa7775f2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c8837b4d-bbe4-51fa-829f-a63e4871317b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:6ec8ba4d-68db-58f8-ba56-c74ec42dc11a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:d9cf5d06-7b5f-5be8-a75a-1255654fc443", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc, and is fixed in 4.3.21.RELEASE-tuxcare.5." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:2865a633-a1a4-5b0e-98b6-939c49e9d653", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:967b85a7-539a-5bc1-a0a3-c6a21cce9551", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:ec1ae178-3fa4-509f-964c-421140bef9ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c508c862-e4b5-55cc-89aa-e146faa02ccb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:c23a6a79-4c18-5284-acef-4f754937a908", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:574f1c55-0754-5fcd-88a5-70b6943a5c8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:68f6887e-d49e-5393-ac3f-bbce83457767", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter class) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0 (May 2024), approximately 7 years after version 4.3.21.RELEASE (2017-2018). All CVE-2026-47883 backports target only 6.2.x versions, with no backports to any 4.x or 5.x version, confirming t...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:9e5a61c5-640c-5ff6-b9f6-555c86acf9ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:00b5de58-b61e-5adb-987b-2f8d19740688", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:36111835-0fe8-5520-9f86-cccc9d17fd72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.21.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ], "bom-ref": "urn:uuid:11bbd486-8b4c-5796-9cc2-c7e834800370", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.21.RELEASE-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.21.RELEASE is not affected by CVE-2026-59313. The vulnerability requires the functional web framework (RouterFunction, ServerResponse.sse()), which was introduced in Spring 5.0 and does not exist in version 4.3.21. While this version has SSE support via SseEmitter, that implementation already contains proper line separator escaping that prevents the stream corruption vulner...", "justification": "code_not_reachable" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.21.RELEASE-tuxcare.3" } ] }