{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fab1cd3f-3e28-5fb8-874a-a5ed52ffd6da", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a99806a4-5ac2-5c43-aa53-b8c5083524f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework versions before 3.2.8 and 4.0.0 before 4.0.2. The target version 4.3.9.RELEASE is much newer and already contains the upstream XXE defense. The Jaxb2RootElementHttpMessageConverter class has processExternalEntities field (defaults to false) and processSource() method that explicitly disables external entity resolution via SAX feature 'external-general-enti...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:da0f2351-42a8-56ad-8b99-98a3c27751f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is not present in Spring Framework 4.3.9.RELEASE. The fix was already included in the upstream release that TuxCare onboarded. All five XML processing classes (Jaxb2Marshaller, AbstractMarshaller, Jaxb2CollectionHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter) contain NO_OP entity resolvers that prevent external entity resolution by default (processExternalEntities defaults to false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4b6fdd9f-a79b-58bd-a72e-2f8074f33b26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 4.3.9.RELEASE is not affected by CVE-2014-1904 (XSS via unencoded URI in form action attribute). The vulnerability was fixed in upstream Spring Framework before version 4.3.9.RELEASE was released. The fix, which encodes the request URI using UriUtils.encodePath() before writing it to the HTML form action attribute, is present in the target's FormTag.java at lines 465...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:869a8aa9-a5fa-5d3f-823a-8d04ae03c408", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in Spring Framework static resource handling) is NOT present in the target version 4.3.9.RELEASE. The vulnerability affected versions up to 4.1.2, and the fix was already included in the upstream Spring Framework 4.3.9.RELEASE that TuxCare onboarded. All security defenses from the upstream patches are present: processPath() strips control characters and leadin...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7727430d-508d-5fbe-a339-342e27b6f083", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Spring Framework 4.3.9.RELEASE already contains the fix for CVE-2016-9878: ResourceServlet normalizes each requested resource URL with StringUtils.cleanPath before dispatching it, so path traversal sequences are removed (fixed upstream in 4.3.5).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:98a4f4a7-0656-58d2-b142-9193eb7a6f3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.9.RELEASE is NOT vulnerable to CVE-2020-5397. The vulnerability affects Spring 5.2.0-5.2.2 where OPTIONS requests with Access-Control-Request-Method header but WITHOUT Origin header were incorrectly classified as CORS preflight requests. In 4.3.9, the CorsUtils.isPreFlightRequest() method has required the Origin header since 2015 (via isCorsRequest() call), preventing the a...", "justification": "protected_at_runtime" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f3b0c53d-7a5c-5067-a4e5-604e9360b4b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:99b22027-1949-5e91-9860-0b28668314c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1ae72af3-2340-5ff7-adc1-780f6aa67382", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e4ef2402-574c-5c9b-a11f-e6e5ced25421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the micrometer observation infrastructure (ObservationRegistry, ObservationConvention classes) to create unbounded metric dimension cardinality from arbitrary HTTP method strings. This infrastructure does not exist in Spring Framework 4.3.9 - it was introduced in Spring Framework 6.0. Additionally, Spri...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1024944b-b8c3-59cd-a46c-9b5642afc3f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:639ab3e9-6e53-5c90-932b-cf768c1142af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6b7ea285-dcbe-5322-907b-d826104acaa7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:83478e69-8834-554b-92f3-a6b740513da6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7c9c11ad-63fb-5ef3-8cba-f3d62e8a0912", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0df4cdbb-eaae-5e24-9777-394eac397ff1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2e645b4a-d7d5-5430-a63b-8bf949e0f579", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a34a8998-02cd-5104-bae9-b676911883c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0718b5fc-d975-58bb-a46b-f89e999bf798", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:107725b4-4a0f-5923-b3c2-e7bad2f474a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e25d086c-8fbb-5844-9912-d17b33869d03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:0df0f8f3-8200-5edf-bbeb-bf5261c88dcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1d3f7896-24d5-5ce5-a9e3-f8c00220cc02", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:661fa3e5-c9be-5cbb-88c1-ff29b7966caa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d85e319e-1efa-5caa-88d5-71fb14d80f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5d010e33-eefb-57c0-84a8-864220bbc1e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.9.RELEASE is not affected by CVE-2026-47883. The vulnerable component `UrlHandlerFilter` does not exist in this version\u2014it was introduced in Spring Framework 6.2.0-SNAPSHOT, approximately 2 major versions later. TuxCare has backported CVE-2026-47883 fixes to 6.2.x branches (6.2.3, 6.2.5, 6.2.7, 6.2.12, 6.2.14) but not to 4.3.9, confirming this version predates the vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:71e31ce3-b625-5250-b7ef-945e91567fbf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3859252f-d9c0-5280-a344-33ca97ce44cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ca8e2e4d-1579-5dd4-a97c-a53ca523d5b7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. CVE-2026-47890 affects rendering of view fragments as Server-Sent Events, a feature added in Spring Framework 6.2.0. Spring Framework 4.3.9.RELEASE does not contain fragment rendering, so it is not affected.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e9aea50a-aa62-5a56-a01a-b6c333e865a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it does not contain the functional Spring MVC SSE implementation required by this vulnerability, including RouterFunction, ServerResponse, and SseServerResponse. The existing SSE class extends the classic ResponseBodyEmitter API at spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java:39.", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.9.RELEASE-tuxcare.5" } ] }