{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fff7e392-a23e-5ae4-9fc7-0561328c1d14", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5", "version": "5.1.5.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b1131075-3dbd-5672-871a-d1edfe19959b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework versions before 3.2.8 and 4.0.0 before 4.0.2. The target version 5.1.5.RELEASE-tuxcare.6 contains the complete XXE protection that was introduced by upstream Spring Framework in v4.0.2.RELEASE (February 2014). The fix, authored by Rossen Stoyanchev from Pivotal, configures XML parsers to disable external entity resolution by default. The vulnerable code pa...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:91f5b809-444a-5574-a233-d9cce0580a90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. The target Spring Framework 5.1.5.RELEASE is not affected by CVE-2014-0225 because the upstream vendor fix was already present in the 5.1.5.RELEASE when TuxCare onboarded it. All five XML processing classes identified in the security patches contain the necessary defenses: NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER implementations that return empty content, combined with SAX/StAX features that disable external entity resolution by default (processExternalEntities=false). The fix commit 8e096aeef55287dc829484996c9330cf755891a1 by upstream author rstoyanchev@gopivotal.com is an ancestor of HEAD and predates the first TuxCare commit 302ea3312a635f6b6daedf15f517c34a9a8594b7.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a3d5b4b2-fe64-5f21-b2e0-e486fc93f371", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 5.1.5.RELEASE. The XSS vulnerability in FormTag's default action handling was fixed by upstream Spring Framework in commit 741b4b229a (authored by Rossen Stoyanchev). This fix was already present in the 5.1.5.RELEASE before TuxCare began maintaining it. The vulnerable pattern (unencoded URI in form action attribute) does not exist in the target -...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4bd18d90-6b73-5172-9949-7fd13fba6356", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.1.5.RELEASE is not affected by CVE-2014-3625. The security fix for this directory traversal vulnerability was already present in the upstream Spring Framework 5.1.5.RELEASE when TuxCare onboarded the repository. The fix was authored by Rossen Stoyanchev from Pivotal (rstoyanchev@pivotal.io) in commit 9cef8e3001, which is included in the upstream v5.1.5.RELEASE tag....", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dcdefaae-6402-5ef5-85b3-7f7a45b5f4aa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.5.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:36b93934-f0dc-5a16-9aa5-96e68e14a475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc, and is fixed in 5.1.5.RELEASE-tuxcare.8." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:50734640-ec14-5ab9-9f94-2dfd43cc7e87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2626cf1e-4d80-51ee-9366-d94cf83eefbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:115ac5e4-d2ec-5b6f-894a-c67d153ebef2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:858c269e-89ef-5afc-8229-02dd1c6e4691", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.5.RELEASE is not affected by CVE-2023-34053. The vulnerability requires the observation/micrometer integration introduced in Spring Framework 6.0, which does not exist in version 5.1.5. The target processes HTTP requests via Spring MVC/WebFlux, but lacks the observation recording mechanism that would create unbounded KeyValue objects from arbitrary HTTP method names. The en...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e25cf800-d035-5745-a326-d5c5a8250c5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:95641f9f-cdde-5030-9570-7f685e9903ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:26124529-f783-5b61-9070-dd46a9088653", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1b6f549b-79a8-573a-9d4e-05dd77f6e411", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3ddc3be9-e003-5c11-a188-02a60e5f480f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:72157856-8933-54e5-8171-15b1318e8d9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a9720913-1887-555a-9923-e63784113d81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b0350019-2dd7-5558-8c89-d1f38bb48979", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a76db343-25c2-54ca-9b4c-36a338ae6591", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3b6d6db9-7c08-5ccb-be33-d44d72afcabb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc, and is fixed in 5.1.5.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5facb903-d8dc-5dfa-bc71-2bacac0e40ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2120df48-e7e7-5f25-8e9a-5ef16e2009de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3f951714-6a04-5b07-8bc8-d6301b000a9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d07fae17-8956-53dd-ae4c-9b2566a4f721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e4f4f50c-a783-5850-b2a9-8f3966214ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:84a6d6a4-8af0-53e8-97d0-dd76b1a3b716", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-47883 affects UrlHandlerFilter, a component introduced in Spring Framework 6.2 (May 2024). The target version 5.1.5.RELEASE (2019) predates this feature by approximately 5 years. The vulnerable component and its code pattern do not exist in this version. The vulnerability involves UrlHandlerFilter taking request URIs starting with \"//\" and using them directly in redirect Location heade...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:668e8863-8ff4-5dc3-a97c-f72b4fdb4462", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8c7350b8-8876-5426-b141-200e4083292d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8188e9ba-38b3-5bbc-9e57-c602cbc372eb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. Version 5.1.5.RELEASE is not affected by CVE-2026-47890. The vulnerable Fragment rendering feature for Server-Sent Events was introduced in Spring Framework 6.2.0, which is after this version. The target does not contain the Fragment class, FragmentHttpServletResponse class, or the vulnerable getFragmentContent() method. While 5.1.5 does support basic SSE via SseEmitter, that code path already has proper CRLF handling in its writeStringData() method and is not vulnerable to this issue.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c213d3e2-6608-540e-959e-c0f19eb207fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.5.RELEASE-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-59313 specifically targets Spring MVC's functional web framework (RouterFunction, ServerResponse.sse()) introduced in Spring Framework 5.2. Version 5.1.5.RELEASE-tuxcare.6 predates this component\u2014the org.springframework.web.servlet.function package does not exist in this version. All TuxCare backports of this CVE (5.3.3 through 6.2.x) modify only functional framework files (SseServerRe...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.5.RELEASE-tuxcare.5" } ] }