{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:aed90e70-6f43-56ae-a29f-8a6c60ab4279", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12", "version": "6.1.20-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.1.20", "type": "library", "group": "org.springframework", "version": "6.1.20" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:68f9f20a-db20-535b-8548-d66b9aa7b67f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.20 is not affected by CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter). The fix was already present in the upstream 6.1.20 release before TuxCare onboarded it. The vulnerable pattern (unrestricted external entity processing) is not present because the code includes the processSource() method that disables external entity resolution by default (proce...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:25f12339-1b31-5508-81ad-f6b6ecba0f82", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via uncontrolled DTD entity resolution) is NOT present in Spring Framework 6.1.20. The upstream fix was already included in the release that TuxCare onboarded. The fix, authored by Rossen Stoyanchev (rstoyanchev@gopivotal.com) in May 2014, adds NO_OP entity resolvers and sets processExternalEntities=false by default across all XML processing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter), preventing external URI resolution in DTD declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:b3d8f77e-f461-5b97-8076-20e70e880495", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 6.1.20) is NOT affected by CVE-2014-1904. The vulnerability pattern (unencoded request URI used directly in HTML form action attribute) is not present in HEAD. The upstream fix (commit 741b4b229a) that adds URI path encoding via UriUtils.encodePath() was already included in the upstream release v6.1.20 that TuxCare onboarded. The fix was authored by Rosse...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:454708c2-139d-541d-8f0c-36177d1e1cbb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.1.20-tuxcare.13 is not affected by CVE-2014-3625. The vulnerability (directory traversal in static resource handling) was fixed in upstream Spring Framework in November 2014 (commit 9cef8e3001). The target version 6.1.20 was released in 2024 and already contains the complete fix from the upstream vendor (Pivotal/VMware). All defense layers are present: processPath() strips co...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:ab475d18-4ba5-50f7-b01e-87be34b8fff9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.1.20 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:09c08e48-be57-58ab-adcb-c058ec201cc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 is NOT present in Spring Framework 6.1.20-tuxcare.13. The vulnerability was fixed in upstream version 5.2.3.RELEASE (released 2020-01-13), and version 6.1.20 inherited this fix from the upstream release. The fix adds Origin header validation to CorsUtils.isPreFlightRequest() and ensures all valid preflight requests are processed with PreFlightHandler. All four key files (CorsUtils...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:d0a61173-ecf8-5cbb-8e76-f7489bcaf3cd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download attack via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 6.1.20-tuxcare.13. The fix was already included in the upstream Spring Framework 6.1.20 release before TuxCare onboarding. The ContentDisposition class escapes quote and backslash characters via the appendName() method (lines 623-625), preventing header injection attacks. Fix commit 956ffe68 by upstream author rstoyanchev@pivotal.io was shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:c0017acc-cb7a-5517-8bac-9a9e8bdff200", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. Spring Framework 6.1.20 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:0a9476b1-26b3-5564-a9f8-66b5be4eb1f7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2023-20860 affects Spring Framework 6.0.0-6.0.6 and 5.3.0-5.3.25, causing pattern matching mismatch when using \"**\" or patterns without leading \"/\" in Spring Security configuration with mvcRequestMatcher. The target version 6.1.20 is not affected because the upstream fix (commit 202fa5cdb3, March 2023) was already present in the upstream release before TuxCare onboarded it. The fix normalizes patterns by prepending \"/\" to non-empty patterns that don't start with \"/\", ensuring consistent matching between Spring Security and Spring MVC. The fix code exists at PathPatternParser.java:115 and is invoked from HandlerMappingIntrospector.java:544.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:2c9944b6-5859-5168-8280-8bcc7e2db984", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.1.20-tuxcare.13 is not affected by CVE-2023-34053. The vulnerability (unbounded memory allocation from non-standard HTTP method names in observation conventions) was fixed by upstream Spring Framework in version 6.0.14 (commit c18784678df489d06a70e54fcddb5e3821d4b00c by Brian Clozel). This fix was already present in Spring Framework 6.1.0 and all subsequent release...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:c79aec19-abf5-54fa-9322-fb73d3b69727", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.1.20-tuxcare.13. The upstream vendor (Broadcom/VMware) fixed this vulnerability in commit d86bf8b2 (2024-09-02), which was included in Spring Framework 6.1.13 and all subsequent releases including 6.1.20. When TuxCare onboarded version 6.1.20 on 2025-06-19, the fix was already present in the upstream release. Both PathResourceLookupFunction files (WebMvc and WebFlux) contain comprehensive path traversal defenses: path normalization, URL-decoding validation rejecting ../ sequences, and resource location verification.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:bacb5d17-bbaa-58da-97e0-e52c94c923e7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. CVE-2024-38819 path traversal vulnerability is NOT present in Spring Framework 6.1.20-tuxcare.13. The upstream vendor (Rossen Stoyanchev from Broadcom) fixed this vulnerability in commit 3bfbe30a78 (\"Normalize static resource path early\") dated October 14, 2024, which was already included in the upstream Spring Framework 6.1.20 release before TuxCare onboarded it. All four affected resource handler files contain the normalizePath() defense that URL-decodes paths (handling double-encoding) and normalizes them before validation, preventing attackers from bypassing path traversal checks via URL encoding.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:96323ccf-d766-5ce0-879b-7343e420a2ab", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. Version 6.1.20 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:fd34c760-cf75-5b28-bdc0-030efd9addf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:1e9f46b0-78f3-59d7-8d7d-aca862f2f04a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:c42a973e-7afe-5247-b290-1e54d59aef88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:0019c128-d324-5f3f-a74f-9d526f45ba53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:23df3ad8-c60d-5b3f-97e5-18ccc9475ddc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:d37d0f13-d107-5cac-98a2-e542e187bfb8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:d9da4d73-7c2a-5929-ac92-222838d50592", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:76a8b512-c3a0-5147-8ff2-5df3f4a527f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:f3fad976-8091-5c99-b965-a9e7eb45ce01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:16ddb694-1b63-53c8-88e6-b433f4595aef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:09db89db-0700-5259-8ebb-72855313fbdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:e7faad42-6ffc-525e-9f88-d2397d25cb52", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:11681eb8-1e1c-51f7-8882-e36a7fbc9223", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework version 6.1.20 is not affected by CVE-2026-47883. The vulnerable component (UrlHandlerFilter) was introduced in version 6.2.0-M2, which is after the target version 6.1.20. Exhaustive search of the codebase confirms no UrlHandlerFilter class exists, and TuxCare backport history shows CVE-2026-47883 fixes were applied only to 6.2.x versions (6.2.1, 6.2.3, 6.2.5, 6.2.7, 6.2.12-19)...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:43230188-1f84-59b3-bad0-519da5b6d9be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:28b268d2-1248-50c6-afbe-8215da2a995a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:c4eb7c7d-7e6b-58ea-a14a-b43aee2eef7c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc. Spring Framework 6.1.20 is NOT affected by CVE-2026-47890. The vulnerability concerns improper carriage return (\\r) handling when rendering view fragments as Server-Sent Events, causing SSE stream corruption. However, the view fragments feature (Fragment class and fragment SSE rendering) does not exist in version 6.1.20 \u2014 it was introduced in version 6.2.0 (commits ef6a3768ee and 6e55e78b22, July 2024). The vulnerable pattern text.replace(\"\\n\", \"\\ndata:\") was added in commits 622c1b9e8c (Spring MVC) and 8e2b27e5d8 (WebFlux) in August 2024, when SSE fragment streaming was implemented. The CVE version range (6.2.0-6.2.19, 7.0.0-7.0.8) correctly excludes 6.1.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ], "bom-ref": "urn:uuid:2a45556e-f416-5fcf-9653-f067a41c1e9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.20-tuxcare.12 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.1.20-tuxcare.12" } ] }