{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:53d1726f-bf07-501c-8b25-bc9014986c83", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1", "version": "5.2.17.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.17.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c4c4c991-96c1-5164-a31c-ce229c32c7e9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The XXE protection was added by upstream commit edba32b309 authored by Rossen Stoyanchev (Pivotal/VMware) and shipped in the upstream release before TuxCare onboarded version 5.2.17.RELEASE (first TuxCare commit: bac4e012e4). The defense is complete: processExternalEntities d...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4fb7d28-aae9-5fe9-8484-10cb8af165c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 5.2.17.RELEASE. The upstream fix (commit 8e096aeef5 from May 2014) was already included in the 5.2.17.RELEASE when TuxCare onboarded it. The target contains NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER implementations in all XML processing classes (SourceHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter) that return empty content when external entity processing is disabled. Default configuration is secure: processExternalEntities=false in all classes, preventing XXE attacks by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2b6d229c-0b71-5e9e-a3d4-52ee494b5e9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 5.2.17.RELEASE-tuxcare.3. The vulnerability affects versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The upstream fix (URI encoding via UriUtils.encodePath) was introduced in February 2014 and is present in the target code at FormTag.java:649. The fix was already included in the upstream Spring Framework 5.2.17.RELEASE before TuxCare onboarded...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:28aec672-e378-5293-a798-8c6d7965aaf6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is not present in Spring Framework 5.2.17.RELEASE. The fix was already included in the upstream 5.2.17.RELEASE that TuxCare onboarded. All defense mechanisms (path normalization, invalid path rejection, URL decode validation, and location boundary verification) are present and active in the target code.", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ab942038-3048-5228-8254-6a7c2699f7d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.2.17.RELEASE does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1cc0e5c6-70b7-5874-827e-012145d50803", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2020-5397. The vulnerability affects versions 5.2.x prior to 5.2.3. The target version (5.2.17.RELEASE) contains the upstream fix that was introduced in commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze. The fix adds an Origin header check to CorsUtils.isPreFlightRequest() and updates handler mappings to properly process ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:52ccd7df-a337-5cad-8337-0739ec879478", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. The target Spring Framework 5.2.17.RELEASE is not affected by CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename). The vulnerability affects versions 5.2.x prior to 5.2.3, and the fix was included in the upstream 5.2.17.RELEASE before TuxCare onboarded it. The fix (commit 41f40c6c by rstoyanchev@pivotal.io, Dec 2019) adds the appendName() method that escapes quote characters and backslashes in filenames, preventing breakout from the quoted-string context in Content-Disposition headers. All code paths that build Content-Disposition headers use this safe API.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e3b87db6-208a-5020-8532-9eb1559072d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1d7cd6c6-a599-5310-a72c-8544218c5bf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:74608fcf-1fac-5ce3-95d1-8e2e4eca86d7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.17.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2023-34053. This vulnerability requires the Micrometer observation infrastructure (ObservationRegistry, ServerRequestObservationConvention classes) that was introduced in Spring Framework 6.0 and does not exist in the 5.2.x release line. While the target receives HTTP requests with method fields (the attack input), the code path t...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:68c53cc7-7326-544c-ae14-303f336c145c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7da51bf1-df68-5350-b81a-36d51a74af3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8fe6f2ac-3ea2-503e-b47a-684139d78d3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.2.17.RELEASE-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c3be6489-35e0-5786-a81a-145446f9d7bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7ca14dee-fd59-541f-aee9-11b74f80e24c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0fdf7d07-a256-5230-aaab-18f407c48289", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:02464e6a-97d5-54fd-9041-7ea9975147db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07acfc95-91ce-51b4-8a01-15ae7c73d129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d0406af8-4e49-5ad7-a353-33e979b76893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:59e956f6-93a3-586d-aa7b-704ff29362f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9b2620fb-f6b4-5d0c-8df9-2604efaff13a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.2.17.RELEASE-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b907f3b0-b711-59d0-9f28-94cf497ae1f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8d072d93-6bdb-5b3b-8b69-acb10121b67d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9754f135-02d6-5ec9-87ea-f9c68633bf26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:58c9014a-d6cf-5eaf-85ad-2bf2dce9df09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:56d67c5f-4e9c-5b30-b3b4-c40de2b1af82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.17.RELEASE is not affected by CVE-2026-47883 because the vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced later in version 6.2.0-M2 (May 2024), and this target version (5.2.17.RELEASE) predates that feature. The open redirect vulnerability via protocol-relative URLs (e.g., //evil.com) in trailing slash redirect handling...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:df0c519c-cb91-544e-a48d-0f3b586f271f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0a50902d-4cdf-5b22-8102-e9d140d1cb7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c95c67c9-7376-5254-bde5-0dcffe3923c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.2.17.RELEASE does not contain the vulnerable Fragment rendering feature. The SSE Fragment rendering functionality that CVE-2026-47890 addresses was introduced in Spring Framework 6.2.0 (August 2024) and does not exist in version 5.2.17. The vulnerability specifically affects Fragment rendering with SSE streams, which is absent from the target codebase. Version 5.2.17 does contain SSE support (SseEmitter), but its existing string escaping logic already properly handles both \\r and \\n characters, and there is no code path that renders view fragments into SSE events.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:04485039-a65c-5f86-925e-bbeeacdbef3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59313 does not affect version 5.2.17.RELEASE-tuxcare.1 of org.springframework:spring-webmvc. Re-checked 2026-11-10 by the vulnerability checker and confirmed by an independent code review: not affected. This version is not affected because the vulnerable Server-Sent Events implementation in Spring MVC\u2019s functional framework is absent. The functional response API has no sse() factory or SseBuilder, and SseServerResponse is absent from the project (spring-webmvc/src/main/java/org/springframework/web/servlet/function/ServerResponse.java:97 and :215).", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.17.RELEASE-tuxcare.1" } ] }