{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d7b08fe5-d056-5502-bd7c-ad8b1637282b", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1", "version": "5.1.1.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.1.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8acd7660-4589-5971-9cb0-36c899409a5b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 5.1.1.RELEASE) is not affected by CVE-2014-0054. The vulnerability concerns XML External Entity (XXE) processing in Jaxb2RootElementHttpMessageConverter, which was fixed in upstream Spring Framework 3.2.8 and 4.0.2 (Feb 2014). The fix was already present in the 5.1.1.RELEASE upstream release that TuxCare onboarded. The vulnerable pattern (lack of external...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9da85cda-d18d-5248-b149-71b5372d7382", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-f93f-g33r-8pcp (affected up to 4.0.5), NVD (affected up to 4.0.4), CVE record (affected up to 4.0.4).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f0d0b9d0-6d15-53aa-b334-242209632991", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 5.1.1.RELEASE. The XSS vulnerability in FormTag's default action handling was fixed by upstream commit 741b4b229 (February 2014) which added URI encoding via UriUtils.encodePath(). This fix was already included in the upstream 5.1.1.RELEASE (November 2018) that TuxCare onboarded, as confirmed by git ancestry analysis showing the fix commit predat...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38be09ee-ace3-587c-84c8-436e72b287b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in static resource handling) is NOT present in Spring Framework 5.1.1.RELEASE. The upstream fix (commit 9cef8e3001, SPR-12354) was applied by Pivotal in November 2014 and shipped in Spring Framework 4.1.2+. Version 5.1.1.RELEASE (released 2018) contains all defensive mechanisms: input normalization (processPath), URL-decode checks (isInvalidEncodedPath), direc...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:67eba015-52e2-57f3-9c06-dfe47cfa130f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: No vulnerable code from the fix was found; the vulnerable lines are absent, and this version declares none of the classes the fix changes. Version 5.1.1.RELEASE is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-2m8h-fgr8-2q9w (affected up to 4.3.5), NVD (affected up to 3.2.0), Snyk (affected up to 4.3.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7bdeefbc-97ab-5c32-b0ac-11217d93b517", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target version 5.1.1.RELEASE is not affected by CVE-2020-5397. The vulnerable pattern (missing Origin header validation in CORS preflight detection) was introduced as a regression in Spring Framework 5.2.x but was never present in 5.1.x. The 5.1.1.RELEASE version already contains the Origin header check in CorsUtils.isPreFlightRequest() via the isCorsRequest() call, which was added by upstream ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b1d743e6-7832-588e-a808-89196bba5266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:315b5634-4fcc-5f5c-b4bb-cf701518df1a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:517f73f9-c036-51a3-b6b6-743d75ca922a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a9b83c5a-bd96-5dd2-9641-11710f55f0fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.1.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation/micrometer integration code (DefaultServerRequestObservationConvention classes) that creates unbounded KeyValue allocations from arbitrary HTTP method strings. This entire observation/metrics integration feature does not exist in version 5.1.1.RELEASE\u2014it was introduced in Spring Framewo...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e6a63a2-27b4-52ec-a4a4-f1b12f5033c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38816 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b3e4a9a-636a-5f55-b971-76926afca911", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ddc03cf-c0ef-5827-8573-f8190ccbc64b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e8e9e07e-bf4b-5d81-98d9-7767956ef2df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e486cdbc-9add-555d-b179-9700f39dd17c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:58f345ba-95bc-5200-aa5c-b352707ce457", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7acee23d-ba52-5b22-bd04-7bbe723102bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:232ef5fc-ee5b-5d9d-9cf2-a8515658a2f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83ec31b5-0364-51a5-b366-8cb8966e6f46", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:64fc1833-c5b0-5d2a-a8c6-bc1965f992b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec519fdc-cd71-5ca4-b1e7-f0e39086df5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ff7d9a9c-ea88-537c-900f-0d1c8d0d4f10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e0645fc4-fd50-5380-a2b7-d5cbc68b1be7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b80c279-aa1d-56c3-9621-15c418b254ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7968cd70-5f7a-5433-b00a-9f862313df60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8a5a0395-af35-50e9-8b46-f777b80c0f36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.1.RELEASE is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter class) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0 (May 2024), approximately 5.5 years after version 5.1.1.RELEASE (October 2018). TuxCare backports of this CVE exist only for 6.2.x branches, confirming that 5.x versions lack the vulnerable c...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:438b1a04-113c-55b0-be5f-b5eb0bb1a576", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2992c68c-5dc4-5840-9183-9f79d319d32d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bdfec305-acd5-5c32-bd7b-96337ac85cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47890 affects version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:18d05a07-0138-5a0b-bf6c-415629a860c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.1.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.1.RELEASE is not affected by CVE-2026-59313 because the vulnerable component (functional web framework's SSE implementation in spring-webmvc/function/SseServerResponse.java) does not exist in this version. The functional web framework's SSE support was introduced in version 5.3.10 (November 2020), while 5.1.1.RELEASE was released in October 2018. TuxCare backported this CVE...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.1.RELEASE-tuxcare.1" } ] }