{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:18ec1369-c9ad-5d75-987a-211d47995717", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8", "version": "6.2.15-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.15", "type": "library", "group": "org.springframework", "version": "6.2.15" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:43ebf6ce-4302-55a5-9f95-7c8df20e2a0a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 is NOT present in Spring Framework 6.2.15-tuxcare.8. The XXE (XML External Entity) vulnerability in Jaxb2RootElementHttpMessageConverter was fixed by the upstream Spring Framework team in February 2014 (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398). This fix was already included in the upstream 6.2.15 release that TuxCare onboarded, so the vulnerable code pattern has never exis...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:d40a8da5-e1f0-52dc-a764-ecaff6d71075", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.2.15 is not affected by CVE-2014-0225 (XXE vulnerability). The upstream fix was already included in the Spring Framework 6.2.15 release that TuxCare onboarded. The fix commit 8e096aeef55287dc829484996c9330cf755891a1 by upstream author rstoyanchev@gopivotal.com added NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER implementations that prevent external entity resolution by default (processExternalEntities = false). All XML processing classes (SourceHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter) have these protections enabled.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:db1e0a37-5677-5d6a-90f6-28adc3ac5342", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 affects Spring Framework 3.0.0-3.2.7 and 4.0.0-4.0.1, where FormTag.java uses the unencoded request URI as the default form action, allowing XSS injection. The target version (6.2.15-tuxcare.8) is NOT AFFECTED because the upstream fix (commit 741b4b229ae) was already present in Spring Framework 6.2.15 before TuxCare onboarded it. The fix applies URI path encoding (UriUtils.encodeP...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:a754e160-a969-517b-b1e3-21c40f3dc11a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is not present in Spring Framework 6.2.15. The directory traversal vulnerability in static resource handling was fixed by the upstream vendor (Pivotal/VMware/Broadcom) in version 4.1.2 (November 2014). The target version 6.2.15 is 10+ major versions beyond the affected range (3.0.4-4.1.1) and contains all required defense mechanisms: path normalization removing control characters ...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:aa463fc5-6a06-50a9-9fc6-5d665a47e73c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.15 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:6a741dcc-0626-58f3-a06f-ff13942a81dd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 is not present in Spring Framework 6.2.15. The vulnerability allowed CSRF attacks through malformed CORS preflight requests (OPTIONS with Access-Control-Request-Method but without Origin header). The fix was committed upstream on 2020-01-10 by S\u00e9bastien Deleuze (sdeleuze@pivotal.io) and was already included in the upstream Spring Framework 6.2.15 release that TuxCare onboarded. Bo...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:9974a7f5-7fda-5d28-abd4-46c93ddb9999", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. The target Spring Framework 6.2.15-tuxcare.8 is NOT AFFECTED by CVE-2020-5398. The vulnerability (unescaped double quotes in Content-Disposition filename parameter allowing header injection) was fixed in upstream commit 41f40c6c by Rossen Stoyanchev (rstoyanchev@pivotal.io). This fix was already present in the upstream Spring Framework 6.2.15 release that TuxCare onboarded (commit 530f923fc0 by evasilev@cloudlinux.com on 2024-11-02). The defense code (appendName() method at lines 616-630) properly escapes both double quotes and backslashes before serializing filenames to HTTP headers, preventing the attack vector described in the CVE.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:9700a777-d863-5880-8a5d-80ae8bf77392", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.2.15 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:7e8dfab6-2557-5d02-9101-7858159767d6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.2.15 is not affected by CVE-2023-20860. The vulnerability pattern (pattern matching mismatch allowing \"**\" without \"/\" prefix) was fixed by upstream Spring Framework before version 6.2.15 was released. The fix is present via PathPatternParser.initFullPathPattern() which normalizes patterns by prepending \"/\" when needed. Original fix commit 202fa5cdb3a3d0cfe6967e85fa167d978244f28a (March 2023) by rstoyanchev@vmware.com, later refactored in 20afa3265a2 (July 2023). Both commits were in the upstream release that TuxCare onboarded as 6.2.15.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:71d2d81b-86a8-5f4d-a0b8-cb50db0f5bca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 affects Spring Framework 6.0.0-6.0.13. The vulnerability allows DoS through unbounded memory allocation when attackers send HTTP requests with arbitrary method names, causing unlimited KeyValue object creation in the observation/metrics system. The target version 6.2.15 is NOT vulnerable - the fix was shipped in upstream Spring Framework 6.0.14 (commit c18784678d by Brian Clozel)...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:4828d5fc-34d0-5054-8a59-cbd37a73bad7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Spring Framework 6.2.15 is NOT vulnerable to CVE-2024-38816 (path traversal in RouterFunctions static resource handling). The upstream Spring Framework 6.2.15 release already shipped with the complete fix authored by rossen.stoyanchev@broadcom.com in commit d86bf8b2056429edf. TuxCare onboarded this version with the fix already present; no backport was needed. The defense validates and decodes URL-encoded paths to detect path traversal sequences (e.g., %2e%2e%2f \u2192 ../) before resolving file resources.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:946cd28b-0d49-54e1-ac18-677b8232bcbb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-g5vr-rgqm-vf78 (affected below 6.1.14), CVE record (affected up to 6.1.13), Snyk (affected below 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:faa4a748-1158-5147-bfbf-083573f432c8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. Version 6.2.15 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:bf12a5ca-ad8d-51ea-abf2-052ca97c2f1e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41242 does not affect version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.15-tuxcare.8 is NOT affected by CVE-2025-41242. The path traversal vulnerability in StringUtils.uriDecode was already fixed in the upstream Spring Framework 6.2.15 release (commit 24e66b63d1 by Patrick Strawderman, merged in v6.2.10). The vulnerable code pattern that processed Unicode characters through ByteArrayOutputStream with charset re-interpretation is not present in ...", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:23b313f3-96f1-5dd2-af6f-10da09c37c11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:d57ccf46-2b3d-55c2-9bde-11d39928804a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:12158276-d3a6-5390-82bf-5343ab56758c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:96ecb513-2122-542c-85c2-2ef87cd05ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:170c9951-21d1-51e1-83b7-2ed35618d86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:306ee26c-34b8-56b5-9101-cabca6aad69f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:38b6d535-89d6-580c-8582-a5f154181a48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:77085e64-aa80-50f7-a3f6-75a319ad5eec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:0d227927-2e60-5b3d-928d-e24808385430", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:9b9f51f2-c8c1-524d-8e1d-b61f1bc0a468", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:0a8f5efb-ee83-5a12-8943-f04d7391be32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:7cbe1b4c-88c5-5d29-a297-fb4dfb4abaf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:0bff419f-d572-5d42-ba92-0f7fd4172ab6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:1714d5a7-0bf7-585d-84fd-4d5017a06a62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:6cea7df2-3f44-5e19-b866-60528b2a40d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ], "bom-ref": "urn:uuid:f8070392-1db4-5441-8c52-60d2d82d0b6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.15-tuxcare.8 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.15-tuxcare.8" } ] }