{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0c5a191-f7f4-5f9d-b6e1-450d05173cb1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2", "version": "5.3.32-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3cba2f40-0d44-56a0-8106-ab68602bc553", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework before 3.2.8 and 4.0.0 before 4.0.2. The target (Spring Framework 5.3.32-tuxcare.3) is NOT affected because the upstream vendor's XXE fix (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 by rstoyanchev@gopivotal.com) was already present in the Spring Framework 5.3.32 release that TuxCare onboarded. The vulnerable pattern (unrestricted external entity proce...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:e0fa92bf-d3d9-573e-9d61-19db760590cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is not present in Spring Framework 5.3.32. The upstream fix (commit 8e096aeef5, authored by rstoyanchev@gopivotal.com on 2014-05-19) was already included in the upstream 5.3.32 release before TuxCare onboarded this version. All affected XML parsing classes (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) have NO_OP_ENTITY_RESOLVER implementations that return empty content when external entity processing is disabled, which is the secure default (processExternalEntities = false).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:b5752af3-4c3a-59dc-ad14-ad2ba9879167", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 describes an XSS vulnerability in Spring MVC's FormTag where the request URI could be injected into the form's action attribute without encoding. The target repository (Spring Framework 5.3.32) is NOT AFFECTED because the upstream fix was already present in the 5.3.32 release that TuxCare onboarded. The fix (commit 741b4b229a by Rossen Stoyanchev) adds URI encoding via UriUtils.en...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:c6aba2c7-8b9d-5b3f-ab03-6db092391343", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is not present in Spring Framework 5.3.32. The vulnerability affects versions 3.0.4 through 3.2.x before 3.2.12, 4.0.x before 4.0.8, and 4.1.x before 4.1.2. The fix was introduced in upstream commits 9cef8e3001, 161d3e3049, and related patches in November 2014, adding comprehensive path validation and location verification defenses. These fixes were already present in the upstream...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:809bc2ec-52a1-58e3-b70a-e368b5f6bacc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 5.3.32 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:4d6a76b4-169e-538f-90f8-01ce39fae1e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 5.3.32 is NOT vulnerable to CVE-2020-5397. The vulnerability affects Spring Framework 5.2.x prior to 5.2.3, where CORS preflight requests could bypass CORS validation and reach application endpoints. The fix (commit bc7d01048579430b4b2df668178809b63d3f1929) was released in upstream v5.2.3.RELEASE in January 2020 and is present in target version 5.3.32. The fix adds a...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:b87ff6fc-bed8-5ee1-93ec-c7be8ddd0e37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download attack via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 5.3.32. The vulnerability was fixed in upstream commits 41f40c6c22 and 956ffe6858 by adding quote escaping logic, and these fixes were already included in the upstream Spring Framework 5.3.32 release that TuxCare onboarded. The target code contains the fix via the appendName() method (lines 503-517 in ContentDisposition.java) which escapes quotes and backslashes before serializing filenames to the Content-Disposition header.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:e9ebf347-54ff-571a-9c37-1a372cf6c517", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:a996abe8-e26a-5dce-ac68-9090bc844cfe", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. CVE-2023-20860: Spring Framework 5.3.32 is NOT AFFECTED. The vulnerability pattern (pattern matching mismatch between Spring Security and Spring MVC when using \"**\" patterns) is not present because the target contains the upstream vendor fix. The fix normalizes security patterns by prepending \"/\" to non-empty patterns lacking a leading slash, ensuring consistent interpretation between Spring Security's mvcRequestMatcher and Spring MVC's handler matching. This fix was included in Spring Framework 5.3.29 (released upstream in July 2023) via commit 1cd994d3a886 by rstoyanchev@vmware.com, which predates the TuxCare onboarding of version 5.3.32.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:aa4c2699-1909-567d-b879-662886e260f0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2023-34053. The vulnerability requires the Micrometer Observation API infrastructure (org.springframework.http.server.observation.DefaultServerRequestObservationConvention) which was introduced in Spring Framework 6.0 and does not exist in the 5.3.x line. While 5.3.32 processes HTTP requests and extracts method names, it lacks the observation/metri...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:ac077ebe-18e3-55d9-851f-627e46bc7203", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:91b73c83-f0a7-5497-8acc-81d2075ac325", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3c3d4b3f-f22e-5a73-b31d-7cbe5b921821", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38828 affects version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:cfcd18bb-3b93-513f-b5d7-cb99c249df5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:6f569ad3-101d-5735-907a-80a772550ce9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7727a614-d43c-5cd6-a6e2-32c942e5886d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:a8bf3ba1-af21-55d0-8447-11d843eb79b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:966e7565-09b7-5807-ae4c-5a9538a0d1fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:09321ff7-93a7-5774-acb9-2b40cedcdfc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:41005a5f-2b1a-582a-8743-ad9afef5dc13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7195dce1-1bb5-5867-a552-6d7d4c55cdd2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:e5d156f0-341e-56d1-bc6b-9429a5e68875", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:b105d4a7-136b-5958-893f-dcd7236473e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:e7db152d-8ec9-5c59-9070-a29c1ec551d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:f243ad7a-1f77-5d7c-b382-0e82ad5c5ea6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:407fe013-af7c-58b6-b278-184a46f07514", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47883 because the vulnerable component (UrlHandlerFilter) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.x (May 2024), well after the 5.3.x release line. The target version lacks the code path that creates the open redirect vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:65f1edb0-cb84-513f-ae6a-19113e8ba78b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:0605574c-dfb1-5408-8837-d574e616d7a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:8e37866f-becf-57d4-9e92-adb42cedecfd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.3.32 predates the introduction of SSE Fragment rendering support (added in 6.2.0 milestone, August 2024). The Fragment API and associated SSE fragment rendering code do not exist in version 5.3.32. The vulnerable code pattern (improper escaping of carriage returns in SSE fragments using `.replace(\"\\n\", \"\\ndata:\")`) is absent because the entire Fragment rendering feature is absent. CVE-2026-47890 affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8 where this feature exists; version 5.3.32 is not affected as it lacks the vulnerable component entirely.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:f8101e1e-6a43-531b-8d80-ecadf1c95067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.32-tuxcare.2" } ] }