{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:747f2784-ebc2-58dd-bae8-62937dd483b6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2", "version": "5.0.19.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.19.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:16f2aaac-c6ab-5d7d-b658-b61656eb0f1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in target version 5.0.19.RELEASE. The upstream fix (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398, authored by Rossen Stoyanchev at gopivotal.com on 2014-02-18) was already included in the upstream v5.0.19.RELEASE when it was released on 2020-09-15. TuxCare onboarded this already-fixed version. The defense disables XML...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3801cda9-f1d6-5232-8ea3-4f6c8e483eec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.0.19.RELEASE is not affected by CVE-2014-0225 (XXE vulnerability). The upstream vendor (Pivotal/VMware) fixed this vulnerability in May 2014 with commit 8e096aeef5, which added no-op entity resolvers to prevent external entity resolution in XML DTD declarations. Spring Framework 5.0.19.RELEASE was released in September 2020, over 6 years after the fix, and therefore already contained the complete mitigation when TuxCare onboarded this version. The vulnerable pattern (XML parsing without entity resolution protection) is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b576447f-8665-5196-bfb8-4fc79c7b235f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability in Spring MVC FormTag is NOT present in this target. The upstream fix (applying UriUtils.encodePath to requestUri before using it in the form action attribute) was already included in Spring Framework 5.0.19.RELEASE when TuxCare onboarded it. The vulnerable code pattern does not exist in the target.", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55ce51ca-bc5a-5a09-ad78-b80b6df5f3ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is NOT present in Spring Framework 5.0.19.RELEASE. The upstream fix (commit 9cef8e3001ddd61c734281a7556efd84b6cc2755 by rstoyanchev@pivotal.io) was already included in the upstream Spring Framework 5.0.19.RELEASE when TuxCare onboarded it. The target contains comprehensive defenses against directory traversal: processPath() strips control characters, isInvalidPath() rejects \"../\",...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aeb619e3-4a5f-5b36-887e-e6c9eda23318", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.0.19.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1538b2df-2560-59a9-91bb-77e7d268ea27", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87aa5a91-1f77-564b-b6d0-e10321ee7249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename) is NOT present in target version 5.0.19.RELEASE. The vulnerability was fixed in upstream Spring Framework v5.0.16.RELEASE (January 2020) via commit 0583b334b4 by rstoyanchev@pivotal.io, which added quote-escaping in the ContentDisposition.appendName() method. Version 5.0.19.RELEASE inherits this upstream fix\u2014it was already present when TuxCare onboarded the version (first TuxCare commit d5717cf235c). The target's ContentDisposition.java (lines 414-428) contains the appendName() method that escapes quote and backslash characters before appending them to the header, preventing header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6e5b8eba-a4a0-536d-9ec2-ce78b77ca281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b38d334-fa25-5140-8ecd-13e98b7781cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5687cd2-3b04-5fe5-baac-41582c4e4b5f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.19.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2023-34053. The vulnerability exists only in Spring Framework 6.0.0-6.0.13 where the Micrometer observation integration creates unbounded KeyValue objects based on arbitrary HTTP method names. Spring 5.0.19 lacks this entire observation integration: no DefaultServerRequestObservationConvention classes, no ObservationRegistry, no i...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:651e1cba-2828-56f3-b1f9-baecdbbbe2c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3e0403e-cb6c-5dc4-986c-9e2cd3a78202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be3c070a-40be-5d02-a834-b18090707100", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a9289cb-4733-50d9-85a8-9d5cb710cbdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a8880bd-2560-5b35-96c7-5c90ea871407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3024db5b-0980-5306-9f5c-3743b46cfc28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56933a5f-5a6e-57a9-8436-38080289bb24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4295ae28-484d-5b10-9d41-7a099dd1b70c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f2645b96-2e8d-5bcf-a81f-003b1c9e7ce3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.0.19.RELEASE-tuxcare.4." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5a8c17d8-542f-5908-a740-84075aa25288", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.0.19.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:642b8bff-8b8c-5427-a2d7-92d0ce131bc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb91b679-ee22-52fa-8e50-163176172839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:650b46f7-fb14-5413-8abc-c04e80ce6b53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4415a1c1-b704-509d-adfd-60ecbe06e2d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3ccb797-db1b-50d1-afd2-748c2a0c886a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39055077-1030-512e-b802-d8ee99e3ad1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.19.RELEASE does not contain the UrlHandlerFilter class that is the subject of CVE-2026-47883. UrlHandlerFilter was introduced in version 6.2.0 (first appearing in commit edb6bb717d and first tagged in v6.2.0), which is significantly later than the 5.0.19.RELEASE line. Exhaustive searches across the entire repository found no UrlHandlerFilter implementation in either the ser...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c726649e-85cb-53e1-a5f7-be665d0d7751", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbe0098d-4fe4-5b45-ba23-65dd9e7d7adc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:389d40e2-a659-5f15-aa95-01c70bacea2f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.0.19.RELEASE is NOT AFFECTED by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) with view fragments\u2014a feature that renders HTML view templates and sends them as SSE events with incomplete line-break escaping. This feature was introduced in Spring Framework 6.2.0-M7 (July 2024), years after the 5.0.x release series. Version 5.0.19 does not contain the Fragment class, fragment rendering APIs, or the vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler.getFragmentContent()). Basic SSE string data handling in 5.0.19 already implements proper \\r and \\n escaping, but the fragment-specific rendering code does not exist.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a01aa7e-e014-5a4c-af5f-810c93f12aa1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.0.19.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. The CVE explicitly concerns MVC functional SSE, and the patch exercises `ServerResponse.sse()` (patch:140). At HEAD, the entire `org.springframework.web.servlet.function` source package is absent, confirmed by the tracked tree and source searches; the existing functional `ServerResponse` belongs to WebFlux (ServerResponse.java:17). The remaining MVC emitter rejects CR/LF in id/event and handles CR, LF, and CRLF in string data (SseEmitter.java:244, SseEmitter.java:249). However, both remaining writers escape only LF in comments, contradicting the current run\u2019s claim of complete runtime protection (SseEmitter.java:221, ServerSentEventHttpMessageWriter.java:139). The not_affected verdict therefore rests on the missing CVE-specific component.", "justification": "protected_at_runtime" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.19.RELEASE-tuxcare.2" } ] }