{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:51e71a7e-1bbb-57ad-9b4e-18d0015aa1df", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8", "version": "6.0.11-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1be83615-1f4b-5820-920e-3e365022edb5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.0.11-tuxcare.6. The upstream fix (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398 by rstoyanchev@gopivotal.com) was already included in the Spring Framework 6.0.11 release when TuxCare onboarded it. The fix adds a processSource() method that wraps StreamSource inputs with SAXSource configured to dis...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:00fc5330-0fc9-58ee-95a0-3024789a787c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. CVE-2014-0225 describes an XXE vulnerability in Spring Framework versions 3.0.0-3.2.8 and 4.0.0-4.0.4 where XML parsers did not disable external entity resolution by default. The target is Spring Framework 6.0.11-tuxcare.6, which already contains the upstream vendor's fix from May 2014 (commit 8e096aee). The fix adds NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER that return empty content when processExternalEntities is false (the default), preventing XXE attacks. This fix was shipped in the upstream Spring Framework 6.0.11 release (July 2023) before TuxCare onboarded the version (August 2026). The vulnerable code pattern is not present because the upstream fix is in place and active by default.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:bc0edd3f-905e-55bb-a2c0-06b9f24e2fac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 6.0.11-tuxcare.6. The XSS vulnerability in FormTag.java's default action handling was fixed by upstream Spring Framework in commit 741b4b229a (February 2014) by adding URI path encoding via UriUtils.encodePath(). This fix was already included in the upstream Spring Framework 6.0.11 release that TuxCare onboarded in August 2026. The target code pr...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:243f640b-6af1-5474-9da9-8f2337ce5b70", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.11 is not affected by CVE-2014-3625. The directory traversal vulnerability was fixed by the upstream Spring team in November 2014 (commits 9cef8e3001, 3f68cd633f, etc.) and included in releases 3.2.12, 4.0.8, and 4.1.2. Spring Framework 6.0.11 (released July 2023) inherits all the security fixes from those earlier releases. The target contains all defensive code: processPat...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:34892de4-1043-50ef-9b4d-37cd1cae6312", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.0.11 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1bfb5402-1adf-5fc5-9ef3-6f36fe5fe964", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.0.11 is NOT affected by CVE-2020-5397. The vulnerability (CSRF via CORS preflight requests without proper Origin header validation) was fixed in the upstream Spring Framework release and the fix was already present when TuxCare onboarded version 6.0.11. Both servlet and reactive CORS utilities correctly validate the Origin header in preflight requests, and handler ...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:9a985351-ac79-5cc7-ba2d-48090f36e543", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:c6bec17c-44af-5656-9051-755081389b3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.0.11 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:29c4fe20-58af-5837-9e9a-348e43f94618", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework version 6.0.11 is NOT affected by CVE-2023-20860. The upstream fix (commit 202fa5cdb3) was already present in the 6.0.11 release when TuxCare onboarded it. The vulnerability involved pattern matching inconsistency between Spring Security and Spring MVC when using \"**\" patterns with mvcRequestMatcher. The fix normalizes patterns by prepending \"/\" to patterns not starting with \"/\", which is present in the target at PathPatternParser.initFullPathPattern() line 115.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:bb9dd15c-9345-5485-a7cf-25f4c44c34e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:e1dbb247-c62d-553d-b271-ff7c0a3a7983", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:8531fc21-5ae1-51dc-bd9b-b54242023dd0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:ff89baec-5929-5681-ad4a-a65729785843", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. Version 6.0.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:44cdef06-5ee2-5c8d-9b49-8d07bb07b4ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1df57c5b-cf01-537a-9631-11498575b2f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:f60568dc-462c-50d7-81ef-ee3e55f0c854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:68936a42-5c75-56b5-9e9b-61436e8d75a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1bfa6880-bd32-5eb5-aa72-b3b8e3623626", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:e2e4f2f8-9889-5195-9099-bdbec8e955ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:1b177c7a-e673-522e-83ec-1c60758bf5ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:6da114d8-5f3e-5617-a28a-e0435215cd0a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:0e7e1701-a681-5831-a61b-f423577a4c21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:3f69acf1-2536-52b4-8328-9e61ff11b366", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:d906239b-9727-5865-b7e9-6711b7503262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:6dc72d86-8959-5890-b1b6-31f01ef0633e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:ade14807-5644-59ae-8b9f-006effeeb3df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.11-tuxcare.6 does not contain the UrlHandlerFilter class, which was introduced in version 6.2.x (May 2024). CVE-2026-47883 specifically affects UrlHandlerFilter's trailing-slash redirect logic that can produce protocol-relative URLs (//domain) in Location headers, enabling open redirects. Since UrlHandlerFilter does not exist in 6.0.11, the attack chain from double-leading-...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:52cf3724-d216-5f43-a514-3a12ca889f60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:65d02848-7a67-5745-a4a2-166941d39cd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:97ee27cc-e602-5a88-9d23-85124a9bb699", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ], "bom-ref": "urn:uuid:b2921b44-5046-5290-b03d-30bc46ba2dcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.8 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.11-tuxcare.8" } ] }