{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cf47dab9-01de-5ff2-9710-b70268403ea7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.27.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:24a3f275-2203-5e92-9f76-0130bc0c647e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target version 4.3.27.RELEASE is not affected by CVE-2014-0054. The XXE vulnerability in Jaxb2RootElementHttpMessageConverter has already been fixed by upstream Spring Framework commit edba32b3093703d5e9ed42b5b8ec23ecc1998398, which was included in the upstream 4.3.27.RELEASE before TuxCare onboarded this version. The fix disables external entity processing by default (processExternalEntities=f...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:291a03eb-dd4c-53e0-bb9a-49aa997f42a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 4.3.27.RELEASE. The fix was applied by upstream Spring Framework in May 2014 (commit 8e096aee) and was included in the 4.3.27.RELEASE upstream release (April 2020) before TuxCare onboarded this version. All five affected files contain the NO_OP entity resolver defenses that prevent external entity resolution in XML processing, with processExternalEntities defaulting to false (fix active by default).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72a6ae44-2cde-53e0-b03c-1dd61ec72752", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The target version 4.3.27.RELEASE is not affected because the fix was shipped by upstream in v4.0.2.RELEASE (February 2014). The vulnerable code pattern (unencoded URI in form action attribute) is not present in the target - the fix (URI percent-encoding via UriUtils.encodePath) is present at lines 466-47...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8745b1a0-aa09-57d3-8082-5cd4330c1a81", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in static resource handling) is not present in Spring Framework 4.3.27.RELEASE. The upstream fix (commit 9cef8e3001, SPR-12354) was included in Spring Framework 4.1.2.RELEASE and all subsequent versions. The target version 4.3.27.RELEASE contains all defensive mechanisms: PathResourceResolver.checkResource() verifies resources are under allowed locations, isIn...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2f548775-8bdf-51a8-802d-b1b2d285ac73", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 4.3.27.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:75c13227-f09b-51e3-a57e-9894038c9e29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2020-5397. The target version already includes the equivalent security protection that was later added to fix 5.2.x versions. The vulnerable code pattern (isPreFlightRequest() without Origin header validation) is not present in this version.", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a827213f-4d88-53be-8e8e-0fb3f7468e9e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: No vulnerable code from the fix was found; this version has none of the entry points of the fix's regression test and no class named after a file the fix changes. Version 4.3.27.RELEASE is on an older release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (newer lines only), NVD (newer lines only), CVE record (newer lines only), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ce0b0b68-4113-5993-9f38-64f232c43adc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.27.RELEASE-tuxcare.2." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d156143-211e-5d1c-ba77-68303829a013", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e18a715d-67fe-5f71-9653-5cef202d9953", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation/observability API introduced in Spring Framework 6.0, which does not exist in version 4.3.x. While the target processes HTTP requests and HTTP method strings (the INPUT), there is no code path that leads to unbounded metric cardinality (the GOAL) because the observation framework and M...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:82e53d98-a9f3-5eeb-9e10-cdfe0a6196ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f7aec6a0-4039-5d50-ae2d-22fd19cf325a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f94cc558-6970-5dd7-b2f6-ef0fab65c8dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d8686c77-ab7c-558e-b1c3-3dd9e701d9a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:65dda0ba-1c90-5214-bb8c-76a3ca547da5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8c42039a-a859-5072-a611-f56b649a9b3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:527a494d-d86e-5140-82cf-699c1898a912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:35934b01-f461-5ae3-82a5-76193eaf87d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4a51c089-13a0-53c5-8858-e02c0d67778f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.27.RELEASE-tuxcare.2." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5649ff28-849d-5cad-973d-f0afbacd106f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e75bb3c-069a-594d-a2cf-843b753bddd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:411a5045-f23a-5b13-9be7-1241f081ce43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ae3230a1-89ed-5aa3-aa38-fb134b12e7a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a70d93f4-251b-5ed5-9834-3fe56ca0b1c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6d55511c-c877-5b69-8b31-840d95782c16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 4.3.27.RELEASE-tuxcare.2." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e1544ee7-2487-5bb0-b231-7b81623933cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 4.3.27.RELEASE-tuxcare.1 is NOT AFFECTED by CVE-2026-47883. The vulnerable component `UrlHandlerFilter` does not exist in this version. `UrlHandlerFilter` was introduced in Spring Framework 6.2.0, while the target is version 4.3.27 from the 4.x series, predating this feature by multiple major versions. Analysis confirmed no similar vulnerable pattern exists in the 4....", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c7aa0ebc-d704-538d-9bff-761573f49773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63ea8c25-078f-5017-a9d0-1f34f8bddfb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5ee92bc8-60a4-5bef-8d49-01ea465b41d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.27.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9f6d0e3c-b1d1-51a2-b5c8-5fc5fc62acdd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.27.RELEASE-tuxcare.1 is NOT affected by CVE-2026-59313. The vulnerability requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()), which was introduced in Spring Framework 5.0 and does not exist in version 4.3.27. The vendor backported this CVE to 50+ versions (5.3.x, 6.0.x, 6.1.x, 6.2.x) but zero 4.x versions, confirming 4.x is out of scope. A...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.27.RELEASE-tuxcare.1" } ] }