{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ed16d0b7-c813-56f9-af22-15fb4fe9bf55", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1", "version": "5.3.19-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.19", "type": "library", "group": "org.springframework", "version": "5.3.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:930866e7-737b-558b-a181-9884d7d35b35", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Target Spring Framework 5.3.19-tuxcare.3 is NOT AFFECTED by CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter). The XXE protection fix was shipped in the upstream Spring Framework release and is present in all XML message converters. Upstream commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 (authored by rstoyanchev@gopivotal.com, February 2014) added processExternalEntities fields (defa...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:705dd559-61e3-515f-95d8-fa48972f2f37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.3.19 is not affected by CVE-2014-0225. The XXE vulnerability was fixed in upstream Spring Framework commit 8e096aeef5 (May 2014) by Rossen Stoyanchev, years before version 5.3.19 was released. The fix (NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER that return empty content instead of resolving external DTD entities) is present in all affected XML processing classes and is enabled by default (processExternalEntities=false). This is an upstream fix that shipped in the Spring Framework 5.3.19 release before TuxCare began maintenance.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:01db2133-a88a-50b6-92bf-222c33b7d5c7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability in Spring Framework FormTag is NOT present in target version 5.3.19. The fix (UriUtils.encodePath) was introduced by upstream Spring developer Rossen Stoyanchev in commit 741b4b2 (2014-02-13) and was already included in the upstream 5.3.19 release before TuxCare maintenance began. The vulnerable pattern (unencoded URI in form action) does not exist in the target ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:247c00b0-f858-5373-be0b-f680b24d7136", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 directory traversal vulnerability is NOT present in Spring Framework 5.3.19. The upstream fix (commit 9cef8e3001 by Pivotal engineers) was already included in the Spring Framework upstream release before TuxCare's work on this version branch. The fix adds three defense layers: (1) path normalization removing control characters/leading slashes, (2) validation rejecting traversal se...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e6688eba-6c18-5fd3-82db-4486dd564d1a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.19 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e36e84cd-a840-5f92-a72f-11851c2b4a09", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 affects Spring Framework 5.2.x prior to 5.2.3. The target repository is Spring Framework 5.3.19-tuxcare.3. All components of the security fix are present in the target code: (1) CorsUtils.isPreFlightRequest() properly requires Origin header in both servlet and reactive implementations, and (2) AbstractHandlerMapping routes all preflight requests through PreFlightHandler for proper...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:1910cbf9-e993-508c-834e-2b3b668339ef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. Prechecker: The upstream fix is already in this version's source history (commits 41f40c6c, 956ffe68). Version 5.3.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-8wx2-9q48-vm9r (affected up to 5.2.3.RELEASE), NVD (affected up to 5.2.3), CVE record (affected up to 5.2.3.RELEASE), Snyk (affected up to 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:5dfde543-c0c3-548c-b148-b394c8f753e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.3.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:fc660ca1-e494-5f4f-ae7c-092bbcee2fdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20860 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:1e931432-918a-5e91-8fce-04b44db1fb45", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2023-34053. The vulnerability exists in the observation/micrometer integration layer introduced in Spring Framework 6.x, which allows unbounded KeyValue allocations when processing non-standard HTTP methods. This observation infrastructure does not exist in version 5.3.19, which predates the feature entirely. While the target does receive and proce...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:717502c9-55b7-5989-ad17-94a4f3b5f911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:73973387-f081-524b-8f45-869c76aed9ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:69597958-8e93-53a3-961f-6f4d817e8cb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:e02b3302-2b9f-5e8e-b4bb-5575241e4274", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:29dc3352-e3f3-5f08-bf57-cabb8332bcba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:354f3428-4583-53f1-b34c-158e8f8418ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:cc282467-814c-5c2e-9042-15d0c2c27b0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:1cfba6cd-bd2d-5ca4-b316-045cc4d40773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:df732f3d-a8c6-51d3-85b6-fd826833aae7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c19bfbf6-79a4-54cb-b4d8-13fcc1e4e36e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.3.19-tuxcare.2." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:ef4fec78-1787-57c3-82d9-fbdaaaeb4831", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.3.19-tuxcare.3." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:fdd491fc-00f1-5cd7-9c1b-5ce583cd5e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:14db8286-9c47-5a0b-857d-edc59bfa8d55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:9d9b1743-4ecd-56a6-8669-e9ecc852f513", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc, and is fixed in 5.3.19-tuxcare.4." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:438bcf74-6b03-515a-a072-53d8e6018363", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:c83ca7be-81ea-5ffc-9390-816ac6a48859", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.19 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2 (May 2024, commit edb6bb717d). The target version predates this feature by a significant margin. No alternative code path in 5.3.19 implements the same vulnerability pattern of reading request URIs with double-...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:1219d66e-10ba-5f0c-8b11-3b7c62cc4d96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:f3745ddf-1009-5e64-a208-5de983afe98f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:032c16d6-bcab-5221-b740-bc98ada2f083", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc. Spring Framework 5.3.19 is not affected by CVE-2026-47890. The vulnerability is specific to the SSE Fragment rendering feature introduced in version 6.2.0+ (July 2024). This feature does not exist in 5.3.19. The vulnerable code pattern (Fragment HTML rendering with incorrect CRLF handling using text.replace(\"\\n\", \"\\ndata:\")) is absent. Existing SSE code in ServerSentEventHttpMessageWriter already has correct CRLF handling via character-by-character escaping.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ], "bom-ref": "urn:uuid:51577239-bea5-5b2a-86cb-ab2f86c2bad2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.19-tuxcare.1 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.19-tuxcare.1" } ] }