{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e7d94362-e790-5546-81c4-05622ee5ee2e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12", "version": "6.0.16-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:b613bb11-e8db-5062-a3b2-f047037b3a6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.0.16-tuxcare.11. The upstream vendor (Spring/Pivotal) fixed this vulnerability in commit edba32b3093 (Feb 2014) by adding processExternalEntities protection that defaults external entity resolution to disabled. This fix was already present in the upstream Spring Framework 6.0.16 release that TuxCare...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:3904ff9f-beec-5bb1-a1d4-644e0f5a3a5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. Target Spring Framework 6.0.16 is NOT affected by CVE-2014-0225 (XXE via DTD external entity resolution). The upstream vendor fix (commit 8e096aeef5 \"Disable URL resolution in DTD declarations\" by Rossen Stoyanchev) was already present in the Spring Framework 6.0.16 release before TuxCare onboarded it. All affected XML processing components (Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter, SourceHttpMessageConverter) implement NO_OP_ENTITY_RESOLVER patterns that return empty content instead of resolving external entity URIs when processExternalEntities=false (the default). The fix breaks the attack chain from the Brief's INPUT (XML with DTD external entity URIs) to the Brief's GOAL (external resource access via entity resolution).\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:9c550e85-dbdf-5717-b175-b1efa1712ee3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is NOT present in Spring Framework 6.0.16-tuxcare.11. The XSS vulnerability in FormTag.java was fixed in upstream Spring Framework and the fix was already included in the 6.0.16 release that TuxCare onboarded. The fix applies URI path encoding (UriUtils.encodePath) to the request URI before embedding it in the HTML form action attribute, preventing special characters from breaking...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:b760fbff-8e8d-57cc-abbb-4f45e45a9dd2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.16-tuxcare.11 is NOT affected by CVE-2014-3625. The directory traversal vulnerability was fixed by upstream Spring in November 2014 (commits 9cef8e3001, 161d3e3049, 3f68cd633f) for versions 3.2.12, 4.0.8, and 4.1.2. All security protections are present in the target: processPath() normalizes paths and strips control characters; isInvalidPath() rejects WEB-INF/META-INF, URL ...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:105b465e-997f-535d-b7d1-2d3181e809e8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.0.16 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:4ec49791-671d-52a6-a010-0835e846e945", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 fix is present in Spring Framework 6.0.16-tuxcare.12. The upstream fix (commit bc7d010485, authored by sdeleuze@pivotal.io on 2020-01-10) shipped in v5.2.10.RELEASE and is in HEAD's ancestry. Both defense mechanisms are confirmed: (1) CorsUtils.isPreFlightRequest() now requires Origin header in addition to Access-Control-Request-Method header, preventing malformed preflight classi...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:7bc0971f-dc50-5509-880d-abc80b86f7b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:3a8afe5a-cc57-5c19-aa12-7064317fda1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. Spring Framework 6.0.16 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:87b77d8f-6f68-5312-ac59-9901b24dad7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. CVE-2023-20860 is NOT present in Spring Framework 6.0.16. The vulnerability affected versions 6.0.0-6.0.6, where patterns like \"**\" without a leading \"/\" caused pattern-matching mismatches between Spring Security and Spring MVC. The fix (commit 202fa5cdb3) normalizes patterns by prepending \"/\" to those lacking it, ensuring consistent interpretation. This fix shipped in upstream release 6.0.16 before TuxCare onboarding, making the vulnerable code pattern absent from this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:44120226-cc30-5059-80c4-f6c82e4e6806", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 is not present in Spring Framework 6.0.16-tuxcare.12. The upstream fix (commit c18784678d \"Reduce allocations in server conventions\" by Brian Clozel) was included in the Spring Framework 6.0.16 release that TuxCare onboarded. Both MVC and reactive observation conventions validate HTTP methods against a whitelist of standard methods (GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS, T...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:5c6373f6-e773-5d4f-8b09-3b059975e15c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:f04a6338-3cb3-575d-990c-65b6a1bbf6e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:1c5caad1-e63d-574f-a68f-0cc2d937f193", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. Version 6.0.16 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:74460993-9d65-5622-be29-5c79382e5a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:7fce4eee-5a43-56ea-a374-4d62e8b2631c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:0d85da54-7204-5f6b-9b70-cd3cdf7fba94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:27bf1b0e-15ed-51ec-9001-38da52cd9f27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:854138eb-d289-5393-b618-42870a70d1f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:c91fd526-7587-5236-95c5-79c43772b069", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:b6a368c1-8e33-5bc9-b98b-8fef349eec84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:2a66cf36-2453-53db-9b34-fca67748e644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:758d44d8-ce92-547d-9ccf-3daa390a2779", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:3b492340-38b8-5113-a599-4833d6117d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:ad46ce87-3728-5fa9-849b-2357e93f8f4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:ca948d76-3f8f-5313-aa0a-273b9ef370c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:13dd39a5-4207-5227-b03b-9011fbd841b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.0.16 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter was introduced in version 6.2.0-M2 (May 2024) and does not exist in version 6.0.16. The class is completely absent from both Spring MVC and Spring WebFlux modules in this version. No alternative filter in 6.0.16 implements the same trailing-slash redirect functionality that could exhibit this op...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:2dd9407e-f86b-5463-95fc-2d7675aecb33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:1a0ba21d-8e42-5255-8fb1-c40b45fd5e7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:663214ea-cbdb-578a-afed-fb931892ca6e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ], "bom-ref": "urn:uuid:78b03946-9caf-559d-ad3d-b8b4fd4c7d92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.12 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.0.16-tuxcare.12" } ] }