{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b5c49773-dd99-541b-b45c-13eb34ec76d2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:86d78c76-ccc3-58cb-9534-64e4e07f2bff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework before 3.2.8 and 4.0.0 before 4.0.2. The target version 5.3.29 contains the upstream fix (commit edba32b309, 2014-02-18) that disables external entity resolution by default in Jaxb2RootElementHttpMessageConverter. The fix was already present in v4.0.2.RELEASE and all subsequent releases, including the 5.3.29 release that TuxCare onboarded. The vulnerable p...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9819eb9a-074f-5f56-ac87-3f1cb4c7b6a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. CVE-2014-0225 affects Spring Framework 3.0.0-3.2.8 and 4.0.0-4.0.4 by allowing XXE attacks through unprotected DTD external entity resolution. The target (Spring Framework 5.3.29-tuxcare.12) contains the upstream fix committed on May 19, 2014 by Rossen Stoyanchev (rstoyanchev@gopivotal.com). The fix installs NO_OP entity resolvers that return empty content instead of resolving external URIs, and this protection is active by default (processExternalEntities = false). The vulnerable code pattern is not present in version 5.3.29 as the fix was included in the upstream release before TuxCare onboarding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1805f655-ef57-5c3d-9f45-b8e326f9e4a4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability in Spring MVC FormTag is not present in target version 5.3.29. The fix (URI encoding via UriUtils.encodePath) was applied by upstream Spring Framework in commit 741b4b229ae0 (Feb 2014) and shipped in Spring Framework 3.2.8 and 4.0.2. This fix is present in all subsequent releases including 5.3.29, which TuxCare onboarded in commit fa495141cb. The vulnerable code ...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:342cf368-e29a-577b-b604-82383d96177a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.29 is not affected by CVE-2014-3625. The vulnerability (directory traversal in static resource handling) was fixed in the upstream Spring Framework releases 3.2.12, 4.0.8, and 4.1.2 (commits 9cef8e3001 and 161d3e3049, SPR-12354). Version 5.3.29 already contains this fix as part of the upstream release\u2014the fix was authored by Pivotal/VMware engineers and shipped before TuxCa...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:514f9653-4575-5b43-ac5f-f613d2ea3815", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.29 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:10e0e2ba-6c27-5f61-bced-1e4e72f26c07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.29-tuxcare.12 is not affected by CVE-2020-5397. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929) was already present in the Spring Framework 5.3.29 release that TuxCare onboarded. The fix adds Origin header validation to CorsUtils.isPreFlightRequest() preventing non-CORS OPTIONS requests from being misclassified as CORS preflight requests, thereby preventi...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:23f1dcd2-62c4-5e07-8d77-92539c8e33d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. CVE-2020-5398 is NOT present in Spring Framework 5.3.29-tuxcare.12. The vulnerability (reflected file download via unescaped quotes in Content-Disposition filename) was fixed in upstream Spring Framework before version 5.3.29 was released. The fix (commit 956ffe68587 by Rossen Stoyanchev) escapes double-quote and backslash characters in filenames via the appendName() method, preventing HTTP header injection. This upstream fix was included when TuxCare onboarded version 5.3.29, making the target not affected by this CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:781209ce-cd16-548b-b625-83d1db3064db", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. Spring Framework 5.3.29 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1a32db72-eb6b-54e3-b5db-3d40fedeab7b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. CVE-2023-20860 affects Spring Framework 5.3.0-5.3.25 and 6.0.0-6.0.6. The target version 5.3.29 is NOT vulnerable. The vulnerability pattern (URL patterns not starting with \"/\" causing Spring Security/MVC mismatch) has been removed by an upstream vendor fix (commit 1cd994d3a88 by rstoyanchev@vmware.com, dated 2023-07-11) that shipped with Spring Framework 5.3.29. The fix normalizes patterns by prepending \"/\" via PathPatternParser.initFullPathPattern() in HandlerMappingIntrospector.LookupPathMatchableHandlerMapping.match(). When TuxCare onboarded version 5.3.29 (commit fa495141cbc), the fix was already present in the upstream release. No TuxCare backport was needed for this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:94f60aa5-4f60-588c-ac97-4f4b1aa83dff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.29 is not affected by CVE-2023-34053. The vulnerability requires the micrometer observation API integration (DefaultServerRequestObservationConvention classes) which was introduced in Spring Framework 6.0 and does not exist in the 5.3.x release line. While version 5.3.29 processes HTTP requests with method strings, it lacks the observation code that would create unbounded K...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:93267d65-bfe2-5033-8630-e79207b430c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:46ed5f14-28d4-55da-afb4-67601cef92bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b2b45fc4-76a4-56bc-9980-a946b51f8c6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:a39f01b4-108e-586b-989a-4d2c9e2e30eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c35f68c1-e32f-5385-b6e3-16ed775d61d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c6456cd3-1705-51f9-8ab1-266d6187e761", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:612ab6b5-90a9-5d5c-b5a3-16da22b21ed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4880cbea-2851-5fe5-b266-4181dedacd3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d4e0760f-bc3f-51cf-84bc-819b7f95189a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4e064cc9-2186-5f79-b42d-6a41942f7cc5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c4c4f314-dd85-59d9-86e8-93a490609bd8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc, and is fixed in 5.3.29-tuxcare.12." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:219020b5-c19d-558c-a937-e8d79b63c618", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9256a042-9cc9-53fd-b491-eabbb4cd0031", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:23f20f43-af3b-5c28-bdef-4e06f57c535a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c860f85a-8322-5d6c-91a2-8f447079116c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:48f160a2-6fa3-511d-a07a-a0946b5354c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.29 is not affected by CVE-2026-47883 because the vulnerable UrlHandlerFilter class does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.x (May 2024, commit edb6bb71) and therefore cannot be present in 5.3.29. The CVE has been backported to multiple 6.2.x branches but not to 5.3.29 because the affected code is not present. Exhaustive searches...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:cebb488b-b467-506c-8c1b-81c89b6ebb92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9e666a29-12ec-5cbf-ab5d-97c87d418559", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:733bf6d7-c775-5145-9b62-fbff8761a476", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc. Spring Framework 5.3.29-tuxcare.11 is not affected by CVE-2026-47890. The vulnerability exists in the SSE Fragment rendering feature (FragmentsRendering API) which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.29 predates this feature and does not contain the vulnerable code path. The Fragment class, FragmentsRendering interface, and the vulnerable getFragmentContent() method with improper CRLF escaping do not exist in 5.3.29. While 5.3.29 has SseEmitter support for regular SSE events, it already includes proper CRLF escaping in SseEmitter.writeStringData() for string data. The specific vulnerability affects only the Fragment rendering code path introduced in later versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c2dca221-4ae2-5b83-9790-31f991a1c805", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.29-tuxcare.11" } ] }