{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8d237b89-1c75-5416-84e3-fb55f89c9ce7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6", "version": "5.1.9.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ba4e3ebd-7f86-5484-ae03-c3c0c4fe88f8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 5.1.9.RELEASE. The upstream fix was applied by Spring developer Rossen Stoyanchev on 2014-02-18 (commit edba32b3093) and was already included in the 5.1.9.RELEASE version that TuxCare onboarded. The target code contains comprehensive XXE protections: external entity resolution is disable...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:58f0ef5b-245f-5a70-92f9-a6fc8de54b75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is NOT present in Spring Framework 5.1.9.RELEASE. The upstream fix (commit 8e096aeef5) from May 2014 is an ancestor of HEAD and was already included in the upstream 5.1.9.RELEASE when TuxCare onboarded it. All XML processing classes (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, StaxUtils) contain NO_OP entity resolvers that block external entity resolution by returning empty content. External entity processing defaults to false in all classes, making the XXE protection active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:39e0de22-1897-5775-9fc6-bddeb409469d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.1.9.RELEASE is NOT vulnerable to CVE-2014-1904. The XSS vulnerability in FormTag.java was fixed in the upstream release via commit 741b4b229a (authored by Rossen Stoyanchev on 2014-02-13). The fix encodes the requestUri using UriUtils.encodePath() before placing it in the form action attribute (line 648), preventing arbitrary script/HTML injection. This upstream fi...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5e0c0e67-c336-55c4-a862-e4595526023c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.1.9.RELEASE is not affected by CVE-2014-3625. The vulnerability was fixed by upstream commit 9cef8e3001 (authored by rstoyanchev@pivotal.io) which was already present in the 5.1.9.RELEASE when TuxCare onboarded it. The fix includes comprehensive path validation (processPath, isInvalidPath) that rejects directory traversal patterns (including URL-encoded variants li...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5b2ad7f7-5532-55d2-92a5-f9857234ff55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.1.9.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ad9e7ebd-5831-5571-aab2-7c44d0371a6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d7f3de38-38f1-5f8f-991a-e2d533d292f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5398 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:db307db3-ae97-5e4b-ac3c-8ac388ce9836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fb140410-379e-5fc1-be6f-bb2e4eb5f133", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:ab3d3cac-66f7-56e6-a046-7de09af1295a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.9.RELEASE is not affected by CVE-2023-34053. The vulnerability exists in the observation/metrics infrastructure introduced in Spring Framework 6.0+. The target version (5.1.9) predates this feature entirely\u2014the observation packages and Micrometer integration do not exist in this codebase. While the target does receive HTTP requests with arbitrary method strings, there is no...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:539a9d56-56d8-5fc9-af9f-3d94e46e5ea5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:28e46909-fa94-52d4-981b-66034c387361", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f79e7713-8fc3-5b81-b00d-859f88b737fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:94443d95-17d2-5b19-b6c1-9c1778a11083", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:5326f8a4-694f-5bba-9a01-948d17a555bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e52b162a-e90b-5e83-a22b-29ef3a3c6d9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:c458c65d-0f21-5062-88e4-2a6493d390cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e617596b-e75e-5656-9987-e59279975ceb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0f2ff493-bf1e-56ce-af81-ed243f4d62d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:cc6c153c-129f-5514-863a-ef27598c15da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:dae2dfe8-a71e-59fb-b40e-29cf1d0a85e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1bc0962c-e3b2-554b-9e74-825e16f7de6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f72e38da-b618-54e6-899b-b4e814dfe16c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0dbc4258-023f-57da-abc0-7b09ece8a012", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:4ed916fd-5499-5239-9f7e-72ebfa568241", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e2dd7ceb-e45b-54a0-9fb8-310c26735cd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.1.9.RELEASE-tuxcare.6 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter class) does not exist in this version. UrlHandlerFilter was first introduced in Spring Framework 6.2.0 (May 2024), while this target is version 5.1.9.RELEASE from the 5.x lineage. The specific vulnerable pattern - trailing slash redirect handling that fails to normalize double ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1a6490f5-1993-552e-b9c2-20a56e9350f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:2d122da0-eff2-510c-9f0e-3aceb9d465a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:438889fe-418b-58a4-a0bb-db4742ab4d95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. Version 5.1.9.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE view fragment rendering, a feature introduced in Spring Framework 6.2.0. Version 5.1.9 does not contain the Fragment API or the vulnerable code paths: ResponseBodyEmitterReturnValueHandler and ViewResolutionResultHandler are present but contain no view fragment rendering code.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:73361cd0-946e-5b9d-a22d-ec8e669beb38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.1.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because it lacks Spring MVC\u2019s functional SSE implementation, including SseServerResponse and ServerResponse.sse(). Functional routing belongs to WebFlux\u2019s reactive package (spring-webflux/src/main/java/org/springframework/web/reactive/function/server/RouterFunction.java:17), and existing annotation-based MVC SSE string handling normalizes CR, LF, and CRLF (spring-webmvc/src/main/java/org/springframework/web/servlet/mvc/method/annotation/SseEmitter.java:253).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.1.9.RELEASE-tuxcare.6" } ] }