{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:03e4073d-b4d7-569f-9a60-6779501448a7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6", "version": "4.3.4.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0503dc01-a126-5bad-95e8-09540ffd4788", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 4.3.4.RELEASE. The upstream vendor (Spring Framework project) fixed this vulnerability in commit edba32b3093 \"Add processExternalEntities support to OXM\" authored by Rossen Stoyanchev (rstoyanchev@gopivotal.com) on 2014-02-18. This fix was included in Spring Framework 4.3.0.RELEASE (released 2016-06-1...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:367c199f-496c-55ed-beef-bc9b45a308be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via DTD external entity resolution) is NOT present in Spring Framework 4.3.4.RELEASE. The upstream vendor fix (commit 8e096aeef5 by rstoyanchev@gopivotal.com) shipped in the 4.3.4.RELEASE that TuxCare onboarded. All five affected XML processing classes contain NO_OP_ENTITY_RESOLVER/NO_OP_XML_RESOLVER defenses that return empty content instead of resolving external URIs. The processExternalEntities flag defaults to false (secure by default) across all converters. The vulnerable pattern (unprotected external entity resolution in DTD declarations) is not present.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e0464c7c-4d83-5d65-bfe2-93866fbcc99f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is NOT present in Spring Framework 4.3.4.RELEASE. The fix was applied by upstream Spring Framework in February 2014 (commit 741b4b229a by Rossen Stoyanchev) and shipped in the 4.3.4.RELEASE that TuxCare onboarded in July 2026. The vulnerable code pattern (unencoded request URI in form action attribute) has been mitigated by UriUtils.encodePath() at FormTag.java:467.", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d14ee0d0-74a7-53d0-a171-524baf2c70b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in static resource handling) is NOT present in Spring Framework 4.3.4.RELEASE. The vulnerability was fixed by upstream Spring developers in commit 9cef8e3001 (2014-11-11) and included in v4.1.2.RELEASE. The CVE affects versions before 3.2.12, 4.0.8, and 4.1.2. Since 4.3.4.RELEASE was released after 4.1.2, it includes all upstream security fixes. The target rep...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5778f0b6-05a4-5a18-af87-786cc0a36600", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-9878 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7d48e1d3-355f-577f-94a6-f1c78611280d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2020-5397. The vulnerable code pattern (missing Origin header check in CorsUtils.isPreFlightRequest()) does not exist in this version. The defense was present in the upstream v4.3.4.RELEASE when it was released in November 2016, added by Spring Framework maintainer Sebastien Deleuze in Spring 4.2 (April-July 2015). CVE-2020-5397 documents a ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:38e0a5cd-dee6-59ca-9e65-878ba4b5cf08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c4b317cd-6bb3-551b-a83b-68ef44410bff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:628d6f12-f6d4-5204-9fd6-a2bc43986238", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bc729c63-2c14-5276-be0d-c64ef1f2d92e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2023-34053. The vulnerability requires Micrometer Observation integration (DefaultServerRequestObservationConvention classes) which was introduced in Spring Framework 6.0. Version 4.3.4 predates this integration entirely - the observation/micrometer packages do not exist in the codebase. While 4.3.4 does receive HTTP requests with arbitrary ...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:32869e04-c4b4-5331-b6a4-0cca076864aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:88394398-b1d7-5f5f-9a10-2bca07f1ba89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:8ab34306-135b-5961-ad19-3e879a8f38a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6e747624-c335-50d9-abf0-1106f3ffab97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:497885c5-3e10-5c08-966f-2259d4be4f4e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:60c7b45a-c58c-5ca2-8498-84c4540490af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5a7c5295-b0c2-5bd6-8d4e-844e5eb3a9e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:637b1ec4-848e-5f41-91d4-0dfe87ef6542", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6763e75d-a6d9-5f38-a9d6-b719d4d27fa2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:73c29a96-5ac6-58b1-8e9d-b4a0bec698b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4d8596d5-0827-5c4f-9333-1b671ca48682", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a1026882-f84b-55e0-b3d9-0d88428b86cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:59c3faf9-608b-5b10-b60a-b48a92f9d024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b08eea21-42ce-505b-91c0-284c15b4de3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4755e798-94b7-5185-905a-5ad641723394", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2026-41853. The vulnerability is specific to Spring WebFlux's DefaultServerWebExchange component, which was introduced in Spring Framework 5.0. Version 4.3.4.RELEASE predates WebFlux and uses only the traditional servlet-based Spring MVC architecture. The vulnerable code (DefaultServerWebExchange) does not exist in this version. The upstream...", "justification": "code_not_present" } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b0d7477b-6e57-593e-8c35-d9103c78f7aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.4.RELEASE is NOT affected by CVE-2026-47883. The vulnerable component `UrlHandlerFilter` does not exist in this version\u2014it was first introduced in Spring Framework 6.2.0 (Dec 2024/Jan 2025), while the target version 4.3.4 was released in 2016. The target version predates the vulnerable code by approximately 8 years and 2 major version increments (4.x \u2192 5.x \u2192 6.x). All TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:48fcef1c-0236-5518-86b0-e04ec0942fb9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:7e316c6c-364f-5600-a173-af6fbd3af14d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:9dd9aab1-77ec-5576-af08-febbde3b12b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.4.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ece7f256-675d-540c-840f-e670f1b12e6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.4.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.4 is not affected by CVE-2026-59313. The vulnerability specifically requires Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()), which was introduced in Spring Framework 5.0 and does not exist in version 4.3.4. The vulnerable code path (SseServerResponse.java in the org.springframework.web.servlet.function package) is absent from this version. TuxC...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.4.RELEASE-tuxcare.6" } ] }