{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2215536-e207-5c21-a553-32230563f0e0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7", "version": "5.0.5.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:7bef73a1-cdd0-55cc-9e72-b2387386a23b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2014-0054. The XXE vulnerability fix was already present in the upstream release when TuxCare onboarded this version. The fix, committed by upstream Spring Framework developers (rstoyanchev@gopivotal.com) on 2014-02-18, disables external entity processing by default in both Jaxb2RootElementHttpMessageConverter and AbstractMarshaller by setti...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:c528517d-5aea-5640-9c07-c7fb9b5d6e0a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. The target version 5.0.5.RELEASE is NOT affected by CVE-2014-0225. The XXE vulnerability was fixed in upstream Spring Framework v4.1.0.RC1 (May 2014, commit 8e096aeef5) and is present in all v5.0.x releases. The fix adds NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER to all XML parsers with processExternalEntities defaulting to false, preventing external entity resolution in DTD declarations. This fix was authored by the upstream vendor (rstoyanchev@gopivotal.com) and shipped in the upstream release v5.0.0.M1, predating TuxCare's onboarding of v5.0.5.RELEASE at commit a91b47b9f3.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6f5d3e19-3ad7-5712-835d-ab0fb17002f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is not present in Spring Framework 5.0.5.RELEASE-tuxcare.7. The upstream fix (commit 741b4b229a by rstoyanchev@gopivotal.com) that adds URI encoding to FormTag.java was already included in the Spring Framework 5.0.5.RELEASE that TuxCare onboarded. The vulnerable pattern (unencoded requestUri written to HTML form action attribute) has been replaced with proper URI...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:95391d1a-bcdf-59da-85d4-c381b095781b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2014-3625. The vulnerability affects versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2. Version 5.0.5.RELEASE already contains the upstream security fixes (commits 9cef8e3001 and 161d3e3049) that address the directory traversal vulnerability. These fixes were authored by Pivotal engineers (rstoyanchev@piv...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ccdccde0-bb94-51b0-89cb-1425b406996c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.0.5.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5626429c-aef7-5c67-b3c6-347194ca8fec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Target version 5.0.5.RELEASE is not affected by CVE-2020-5397. The CVE explicitly affects \"Spring Framework versions 5.2.x prior to 5.2.3\". The vulnerability pattern (CORS preflight request processing without Origin header validation) does not exist in version 5.0.x, which has a different CORS implementation that already includes the Origin header check via the isCorsRequest() call in isPreFlig...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:bf12eec9-9c56-5065-83fc-cb5cde5bbca6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b0f60f47-e71e-5bde-ab33-ae3ba79e51b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ca5e1d30-9a14-50db-afbc-4ae713c0dac2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5c67d4e2-95de-52d6-ae5f-0dab93393805", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation/micrometer integration code that was introduced in Spring Framework 6.0.0. Version 5.0.5.RELEASE predates this feature and does not contain the vulnerable DefaultServerRequestObservationConvention classes that create unbounded KeyValue allocations from HTTP method strings. Exhaustive se...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6bc4d05c-f7b3-55a3-9bec-b4a345e7a1b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5d40d218-2de5-51c2-8568-c7132319e076", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:eea1b943-497a-5f7b-a33b-c92e9b808514", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f4a5e31a-f30d-5db3-bb49-64642ffec9a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e497aaae-f705-5794-b27f-2db7a8f98e88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:42da8d6a-4ff5-561a-a15f-44d9c0e69b61", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:73813e20-fe28-52a1-86a5-cd4b24761171", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e1b5719f-28f5-574a-8d2d-b4c4ffc8ebcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:d2ed7645-de8e-5f75-affb-07c86d03f2e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4c9957d1-8448-58f1-8829-3e25540cb2b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:6e29d0ea-4c53-59e5-af9b-bdbe89c5fd50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:27b24d78-c5b8-5786-b03d-6c594a1af679", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:49dd7f30-8268-58b3-943f-63a7b17a1b64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:132e8206-fc9e-5551-95d8-d47262b0693e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:ca9effe4-36de-53cd-83db-c7a7a769ae40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e020d2ab-dc13-58d6-9ab2-fae4e6acec51", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.5.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.x (May 2024) for handling trailing slash redirects. Version 5.0.5.RELEASE predates this feature by several years. TuxCare backported CVE-2026-47883 fixes only to 6.2.x versions where UrlHandlerFilter i...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:626e3a96-f0e9-559a-8fc6-66aae061ad77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:46c5638a-32fe-5851-a99c-6d508c04c78d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8d704e2c-d045-5cd7-96c7-0169c6863fd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. Spring Framework 5.0.5.RELEASE does not contain the SSE view fragments rendering feature that was introduced in version 6.2.0. The vulnerability exists in Fragment rendering code that uses incomplete line break escaping (`text.replace(\"\\n\", \"\\ndata:\")`), but this code path does not exist in 5.0.5. The existing SseEmitter class in 5.0.5 already has correct line break handling (covering CR, LF, and CRLF), but it does not integrate with view fragment rendering. CVE-2026-47890 affects Spring Framework 6.2.0-6.2.19 and 7.0.0-7.0.8; version 5.0.5 predates the vulnerable feature.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:28fd9c66-6af8-5747-9506-c732821905b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.0.5.RELEASE-tuxcare.7 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.0.5.RELEASE is NOT AFFECTED by CVE-2026-59313. The vulnerability specifically requires Spring MVC's functional web framework (spring-webmvc/servlet/function package with RouterFunction and ServerResponse.sse() APIs), which does not exist in this version. The functional web framework was introduced in Spring 5.2+, and TuxCare's backport history confirms this assessment: CVE-20...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.0.5.RELEASE-tuxcare.7" } ] }