{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:52250435-069a-5f1a-86a0-386844635521", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3", "version": "6.1.14-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.14", "type": "library", "group": "org.springframework", "version": "6.1.14" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:16fa349c-b354-5ce0-8adb-80792ec00ee2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.1.14-tuxcare.3. The vulnerable code pattern (XML parsing without external entity protection) does not exist because the upstream vendor (Spring/Pivotal) fixed it in February 2014 (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398), and this fix was already included in the upstream Spring Framework 6.1...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:af1d2404-ae60-5dc9-99c1-0fcdcef0ec5e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2014-0225 affects Spring Framework versions 3.0.0-3.2.8 and 4.0.0-4.0.4 due to XXE vulnerability from unrestricted DTD entity resolution. The target (spring-framework 6.1.14-tuxcare.3) contains the upstream fix authored by rstoyanchev@gopivotal.com in commit 8e096aeef5, which shipped in the upstream 6.1.14 release before TuxCare onboarding (commit 0382968da8). All XML converters (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) and the centralized StaxUtils utility install NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER that return empty content instead of resolving external URIs. External entity processing is disabled by default (processExternalEntities=false). The vulnerable pattern is not present in the target codebase.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:f3794ccf-df21-5432-9af0-543baa4fb5f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Target version 6.1.14 is not affected by CVE-2014-1904. The vulnerability affects Spring Framework 3.0.0 before 3.2.8 and 4.0.0 before 4.0.2. The upstream fix (commit 741b4b229a by Rossen Stoyanchev) was applied in February 2014 and shipped in all releases since Spring Framework 3.2.8/4.0.2. The target version 6.1.14, released ~10 years later, already contains the fix from the upstream release....", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:70d004c7-a278-538a-a66c-39edbc4d3355", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is not present in Spring Framework 6.1.14. The directory traversal vulnerability affecting static resource handling was fixed by upstream in v4.1.2.RELEASE (November 2014) via commit 9cef8e3001. The target version 6.1.14 (released 2024) inherits all security defenses from that fix: processPath() sanitizes paths by removing control characters and leading slashes; isInvalidPath() re...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:4378b45e-5fde-557b-bc34-63e2bd05a87d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.1.14 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b7425f1b-ab6b-5764-95ad-f8355a2d9b9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.14 is not affected by CVE-2020-5397. The vulnerability allowed CSRF attacks via CORS preflight requests that lacked the Origin header. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze, January 2020) was already present in the 6.1.14 release when TuxCare onboarded it in August 2026. All fix components are present: CorsUtils.isPreFlightRe...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:d8773eb4-ee0d-5192-8a1c-240cb67d4f72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2020-5398 affects Spring Framework versions 5.0.x < 5.0.16, 5.1.x < 5.1.13, and 5.2.x < 5.2.3 through a Reflected File Download (RFD) vulnerability when Content-Disposition headers use unsanitized user input in the filename parameter. The target repository (Spring Framework 6.1.14-tuxcare.3) is NOT AFFECTED because the upstream fix (commit 41f40c6c22 by rstoyanchev@pivotal.io, dated 2019-12-19) was already present in the Spring Framework 6.1.14 release that TuxCare onboarded. The fix escapes quote and backslash characters in filenames to prevent header injection attacks.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:d5ea50f3-2249-5c91-8e6c-b3e5df90d816", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.1.14 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:7788f104-8a8d-51f1-a118-6cf4b345e256", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. Target version 6.1.14 is not affected by CVE-2023-20860. The vulnerability affects Spring Framework 6.0.0-6.0.6 or 5.3.0-5.3.25, but the target is 6.1.14, which is newer than the affected range. The upstream vendor fix (pattern normalization to prepend \"/\" to patterns without leading slash) was already present in the upstream 6.1.14 release when TuxCare onboarded it. The fix is implemented via PathPatternParser.initFullPathPattern() method and is used by HandlerMappingIntrospector to prevent the pattern mismatch vulnerability.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:78332e31-ed3b-52d4-b995-33179826606c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework 6.0.0-6.0.13 via unbounded KeyValue allocations when processing HTTP requests with arbitrary method names. The target version 6.1.14-tuxcare.3 contains the upstream fix (commit c18784678d) authored by Brian Clozel (VMware) on Nov 6, 2023. Both DefaultServerRequestObservationConvention classes validate HTTP methods against a fixed set before creating KeyVa...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b945d7df-b4b6-5d8e-b35d-618c489a03bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. Prechecker: An upstream release that contains the fix is part of this version's source history, and the code the fix removes is gone. The upstream fix was released in 6.1.13, and version 6.1.14 is a later release of the same line. Advisories: GitHub GHSA-cx7f-g6mp-7hqm (fixed in 6.1.13), CVE record (fixed in 6.1.13), Snyk (fixed in 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b1a41391-5f94-5164-a73d-91d098513286", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. CVE-2024-38819 path traversal vulnerability is NOT present in Spring Framework 6.1.14-tuxcare.3. The upstream fix (commit 3bfbe30a7814c9ea1556d40df9bd87ddb3ba372d by rossen.stoyanchev@broadcom.com) was already included in the Spring Framework 6.1.14 release before TuxCare onboarded it (commit 0382968da89ef9ad9cb3fd55aa904229c420a71c). All four affected files (PathResourceLookupFunction.java and ResourceWebHandler.java in both WebFlux and WebMvc) contain the complete fix: normalizePath() method with double URL-decoding support and simplified isInvalidPath() validation that rejects paths containing \"../\" after normalization.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:6030a293-bb7e-5332-9d7d-064f471f1c7a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. Version 6.1.14 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:2ce88035-b00f-5469-acde-c2a80dd9a654", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:f344af85-d1dc-574f-853f-78d5fb7933b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:96edd8a4-7951-59e6-9ca1-3c8f12699259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:755df6a1-0b80-584f-bf47-a240e9ec0eda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:b9fd33f8-c2a5-5540-bcbf-5b3d3a89a706", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:a3b9c34a-ceeb-5f82-9d16-32a894f402a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:1a805543-cbeb-50e5-98e2-432ec3edd7b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:9304138d-dd23-56cb-a6a0-1ec5ba459070", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:e3e67a82-868c-5f13-84ee-301d9f8a5d2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:168a3b20-4e2b-5644-a704-2521507f9b06", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:53c15ef4-4581-5b51-8638-67cd4f952b94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:c6eb5bab-e05a-5b69-a79c-cbb0f93b6d31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:99ea1a19-0912-5e2a-91ba-c8d6cf589e7e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-47883 does not affect Spring Framework 6.1.14 because the vulnerable component UrlHandlerFilter does not exist in this version. UrlHandlerFilter was introduced in Spring Framework 6.2.0-M2 (May 2024), after the 6.1.14 release. The CVE concerns UrlHandlerFilter's handling of URIs starting with double slashes (//) in redirect scenarios when configured with broad patterns like /**. Since ...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:8d42ec5f-b5b8-5b15-901d-61e96f3a3f97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:87248eb6-097b-5796-ad5f-1896f9f3c21d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:1c32faf1-d61e-57df-9ccf-5479dfd36a1c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.1.14 is not affected by CVE-2026-47890. The vulnerability exists only in the SSE Fragment rendering feature introduced in version 6.2.0. This feature does not exist in 6.1.14, so the vulnerable code pattern cannot be present. Additionally, the regular SSE support that does exist in 6.1.14 (SseEmitter, ServerSentEventHttpMessageWriter) already implements correct \\r and \\n escaping, identical to what the CVE patch adds for Fragment SSE.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ], "bom-ref": "urn:uuid:73a9ff37-b3db-579e-ab66-e6f1f6293747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.14-tuxcare.3 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.14-tuxcare.3" } ] }