{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:008d2d56-64f4-5f94-8330-c38633c9447e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2", "version": "4.3.26.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.26.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22724d6f-629b-598f-96b8-c1f321b71e74", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 4.3.26.RELEASE is not affected by CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter). The upstream fix for this vulnerability was released in Spring Framework 4.0.2.RELEASE (February 2014) and is present in all subsequent versions, including 4.3.26.RELEASE. The target code contains the complete XXE defense mechanism with external entity resolut...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a342633c-8e9c-51d2-b0dc-ed33bed4a481", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via unprotected DTD external entity resolution) is NOT present in Spring Framework 4.3.26.RELEASE. The upstream vendor (Spring/Pivotal) fixed this vulnerability in May 2014 (commit 8e096aeef5), and this fix was already present in the 4.3.26.RELEASE version when TuxCare onboarded it. All XML processing paths (JAXB, OXM, HTTP converters) have XXE protections: external-general-entities feature disabled, NO_OP entity resolvers installed, and processExternalEntities defaults to false.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aacd6e6b-ba76-5df8-9ce8-c183c135e168", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is NOT present in Spring Framework 4.3.26.RELEASE. The upstream vendor (Spring team) fixed this vulnerability in Feb 2014 (commit 741b4b229a), and the fix was included in the 4.3.26.RELEASE that TuxCare onboarded in 2020. The vulnerable pattern (unencoded request URI in form action attribute) does not exist in the target because FormTag.java applies UriUtils.enco...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c726a931-4c22-5bb6-8f1b-fc9b98017d63", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2014-3625 because the upstream vendor (Pivotal/Spring) fixed this directory traversal vulnerability in versions 3.2.12, 4.0.8, and 4.1.2 (released November 2014). Version 4.3.26.RELEASE, released years later, already contained all the security protections. TuxCare onboarded this version with the fixes already present.", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:abfe29e8-6ec9-5b69-80a0-f6b4698c3616", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 4.3.26.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:919860e3-9039-500a-b994-74f932dbfd38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The upstream fix forces preflight handling even when the handler has no CORS configuration (patches/05-bc7d01048579.patch:220). In this target, `isCorsRequest` means Origin is present, so `isPreFlightRequest` already recognizes OPTIONS plus Origin plus Access-Control-Request-Method without excluding same-origin requests (CorsUtils.java:36). Every such request enters CORS handling regardless of configuration, and its selected handler is replaced with `PreFlightHandler` (AbstractHandlerMapping.java:366, AbstractHandlerMapping.java:465). That replacement only calls the CORS processor; it does not invoke the controller (AbstractHandlerMapping.java:485). Cross-origin preflights without configuration are rejected, and even the processor\u2019s same-origin early return remains inside this dedicated handler (DefaultCorsProcessor.java:75).", "justification": "code_not_reachable" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7500d1a3-dca5-5135-8408-111076fbf7da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a0798a5-c96a-506b-97d9-93d74c00f32f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 4.3.26.RELEASE-tuxcare.3." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5514c0ef-677c-55f3-ab2c-aadfaede9cc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a19d68cc-8ed0-5f8f-bc82-40b1a434d5da", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation/micrometer integration feature that creates unbounded KeyValue objects from arbitrary HTTP method strings, leading to resource exhaustion. This feature was introduced in Spring Framework 6.0 and does not exist in version 4.3.26.RELEASE, which predates it by multiple major versions. The...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:498a4fde-7772-5793-8506-d486c479a3c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:560894f0-772e-596c-af0b-995a338f3b63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:267680a0-e597-5d5c-bbc2-8fbdb9208e0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:42541307-ff09-5048-88dd-4b27e4dfefb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:88ef25fb-75c3-5649-9de8-3e4fc3e507c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39857c64-c4ec-5048-9a40-8be79323aeb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55f93cbc-e3c6-55ff-980e-9cae02d1813f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94801fc0-5e3c-548e-9248-e90337d4c49a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a4c96cdd-2525-5bec-a616-b59d862b8737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 4.3.26.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d6b386a-5a7a-5a07-9c32-54f6ac42f349", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a962d596-7267-507d-a472-dc2647df2758", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8c7ff2b-b8e3-5875-b88e-db15b5bf2611", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d23ae06-da10-525f-a8f4-ef75decefb50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72305060-fce6-58e7-90dd-665fb504f207", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dca45c84-6650-52f5-9287-5addc55c3dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 4.3.26.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f7fc3f95-5b7d-5061-a55a-172c1b23dda9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.26.RELEASE is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter and its trailing slash redirect functionality were introduced in Spring Framework 6.2.0 (May 2024), years after this version. The CVE specifically affects UrlHandlerFilter's redirect handler which takes request URIs and sets them as Location headers without sanitizing leading double slas...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8efea6dc-edf1-5738-8a17-cadf63ad40c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:964aa511-e50d-5d9e-ba2c-d32cd88c8bfb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:146dc3b9-2faf-52f4-a783-50d7484c0488", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.26.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7988004-e22c-51b7-9501-ef3f426d5a81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.26.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.26.RELEASE does not contain the vulnerable code path. CVE-2026-59313 specifically affects the functional web framework (RouterFunction, ServerResponse.sse()) which was introduced in Spring Framework 5.0 (March 2017). The target version predates this feature and does not include the vulnerable SseServerResponse.java class. Spring 4.3.26 uses a different SSE implementation (S...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.26.RELEASE-tuxcare.2" } ] }