{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0f00acc7-0bf7-5a33-9d9a-468b072063ff", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8", "version": "6.0.12-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:0eb579b3-1360-50e1-aa0a-e071d8aa4b26", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework before 3.2.8 and 4.0.0 before 4.0.2 due to missing XXE (XML External Entity) protection in Jaxb2RootElementHttpMessageConverter. The target (Spring Framework 6.0.12-tuxcare.6) is NOT affected because the upstream vendor fixed this vulnerability in February 2014 (commit edba32b309), and that fix shipped in the upstream 6.0.12 release. The fix disables exter...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:2d9f72b3-947a-5a59-9189-be846a8230c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. CVE-2014-0225 XXE vulnerability is NOT present in Spring Framework 6.0.12. The upstream fix (commit 8e096aeef5) shipped in the base release before TuxCare onboarding. All XML parsers in spring-oxm and spring-web modules have NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER installed by default (processExternalEntities=false), preventing external entity resolution in DTD declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f4f6ee01-fd7f-5e1e-98b4-f63c1deed6f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 6.0.12. The vulnerability affected versions 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The fix (URI encoding in FormTag.java's resolveAction method) was applied by upstream Spring Framework in commit 741b4b229a (Feb 2014) and was already included in the upstream 6.0.12 release when TuxCare onboarded it. The vulnerable pattern (unencoded request U...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:419453c4-84a1-5d67-a159-5b9f5b0b7933", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 affects Spring Framework 3.0.4-3.2.11, 4.0.0-4.0.7, and 4.1.0-4.1.1. The target is version 6.0.12-tuxcare.6, which already contains the upstream security fix (commit 9cef8e3) introduced in November 2014. All required defenses are present and active: path normalization strips control characters and leading slashes (ResourceHttpRequestHandler.processPath), path validation rejects WE...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:e67d1892-69db-5710-bc4e-6d215719e6fb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.0.12 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:9b50d7af-f446-5828-ba71-1a55f2eff6b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.12 is NOT AFFECTED by CVE-2020-5397. The vulnerability affected versions 5.2.x prior to 5.2.3, which lacked Origin header validation in CORS preflight request detection. The fix was committed upstream on January 10, 2020 (commit bc7d010) by S\u00e9bastien Deleuze and was already present in the Spring Framework 6.0.12 release when TuxCare onboarded it. All affected components (Co...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:1adcdf0f-df72-5c21-b484-e6caa5041ee5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:60e533f5-b534-5138-acf7-9ce779893ab8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.0.12 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:56914887-f75b-55ad-aab4-9ee22c763042", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. CVE-2023-20860 affects Spring Framework 6.0.0-6.0.6 and 5.3.0-5.3.25, where using \"**\" as a pattern with mvcRequestMatcher creates a security bypass due to pattern matching mismatch. The target version 6.0.12 already contains the upstream fix (commit 20afa3265a by rstoyanchev@vmware.com) that was shipped in Spring Framework 6.0.11. The fix normalizes URL patterns by prepending \"/\" to patterns that don't start with \"/\" before matching, ensuring consistent interpretation between Spring Security and Spring MVC. The vulnerable pattern is not present in the target.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:583bb0ec-2738-5f43-b736-64e7b55459af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3f63a009-413e-5e0b-9c1e-5b5543fa1f3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:d020fefc-d546-5610-96e6-c30168cec99f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:78667051-c1ad-581c-8915-c17bf37a4a71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 6.0.12-tuxcare.7) is not affected by CVE-2024-38828. The vulnerability was introduced in version 6.1.2 (December 2023) through an optimization that caused ContentCachingRequestWrapper to allocate memory based on the attacker-controlled Content-Length header while ignoring the contentCacheLimit parameter intended to prevent excessive allocation. This was f...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:87153580-46fe-527c-b21a-16fb845d6851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:788ec9ab-1b0d-5d99-8f5b-944ea32ce67e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:aeb28ba3-d9e2-560d-9792-ec6ad9be6829", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:6199e68c-1f07-508c-ad9b-a1a979e30e07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:3f8840d9-20c1-5a26-b64b-4eaa161b14d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:9a8927f5-66e1-59d6-bee3-5743abb98054", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:017c9320-f783-5f8d-b7b0-4ce31547cd43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:cb2720e2-46a7-512d-84cb-1719a646bed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:17496464-8954-5b10-8953-11bbaa99e3d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:875e525d-0cab-5ce1-a1f0-3f268c61623b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:79756e48-08ed-5791-90ca-a0a3fdc73ff8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f1ae12ec-45b6-526c-969d-a5d16f4a6e0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:cf091e12-8bd9-5760-9780-efa670fac9b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework version 6.0.12 is not affected by CVE-2026-47883 because the vulnerable component (UrlHandlerFilter class) does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0-M2, which is a later release than the target version 6.0.12.", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:05185a9d-47bd-5da2-9dcf-730ba11ab1b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:484bd9a5-ce9a-532f-93b4-9e521ed24593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:7e2f77fb-fba9-57d8-8f4d-be729e8248ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ], "bom-ref": "urn:uuid:f0a242cc-f772-5439-bdda-001504b7edf0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.8 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.12-tuxcare.8" } ] }