{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e8ca448e-8b3b-56cb-89d5-880b0727dd8f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3", "version": "6.2.19-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.19", "type": "library", "group": "org.springframework", "version": "6.2.19" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:e2e5cc05-e4c3-522d-8d92-384d47bf0357", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 XXE vulnerability is not present in Spring Framework 6.2.19. The upstream vendor fixed this vulnerability in 2014 (commit edba32b3093703d5e9ed42b5b8ec23ecc1998398), adding processExternalEntities support with secure defaults (external entities disabled). This fix was already in the upstream 6.2.19 release when TuxCare onboarded it.", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:a9fc6829-18e9-5f37-abd2-1e54b4422f05", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE vulnerability) is NOT present in Spring Framework 6.2.19-tuxcare.3. The upstream fix commit (8e096aeef5) from May 2014 is present in HEAD and predates TuxCare's onboarding of version 6.2.19. The fix installs NO_OP entity resolvers and disables external entity processing by default across all HTTP message converters and OXM marshallers that process user-provided XML documents.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:257dfcd0-527e-590d-b4a4-dda365ce4d6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 is not present in Spring Framework 6.2.19-tuxcare.3. The XSS vulnerability in FormTag's default action handling was fixed by upstream Spring Framework in February 2014 (commit 741b4b229a). The fix adds URL encoding via UriUtils.encodePath() to sanitize the request URI before inserting it into the HTML form action attribute. This upstream fix was already present in the Spring Frame...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:31d72f93-3783-58fc-a449-df160f967695", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 (directory traversal in static resource handling) is NOT present in Spring Framework 6.2.19. The upstream vendor fix from November 2014 (commit 9cef8e3001ddd61c734281a7556efd84b6cc2755) was already included in the upstream 6.2.19 release that TuxCare onboarded. All five defense layers from the original patch are present: (1) path normalization removing control characters and leadi...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:81b1691d-73e0-5552-bca7-8d3f3451778f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.19 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:753468fe-c768-56b3-96dd-6889c7567bba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.2.19 is NOT affected by CVE-2020-5397. The upstream fix (commit bc7d01048579430b4b2df668178809b63d3f1929 by S\u00e9bastien Deleuze) was already present in the upstream 6.2.19 release that TuxCare onboarded. The fix adds Origin header validation to CorsUtils.isPreFlightRequest() and ensures all preflight requests are processed through CORS handling, preventing non-CORS O...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:f48b3e11-c0af-531b-9562-827788b10e43", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. CVE-2020-5398 is not present in Spring Framework 6.2.19. The vulnerability was fixed by upstream Spring Framework in commit 41f40c6c22 (December 2019) which added quote and backslash escaping to filenames in Content-Disposition headers. This fix was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded, so the vulnerable code pattern never existed in the TuxCare-maintained version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:7acf45d2-5923-5987-b135-85de5f3688e5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.2.19 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:2f7a57ce-8e76-520a-afa8-fa79acc95052", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. CVE-2023-20860 affects Spring Framework 6.0.0-6.0.6 and 5.3.0-5.3.25 where using \"**\" as a pattern in Spring Security configuration with mvcRequestMatcher creates a pattern matching mismatch. The target version 6.2.19 is NOT affected because the upstream fix was already included in the 6.2.19 release. The fix (PathPatternParser.initFullPathPattern() method that normalizes patterns by prepending \"/\" to patterns not starting with \"/\") was introduced by upstream commit 20afa3265a2fb999f9c35d1685ada651fb6fa951 (author: rstoyanchev@vmware.com, July 11, 2023). This commit is an ancestor of the first TuxCare onboarding commit c0bf8335a3431fcf2d7c00d02f53dc437f667125, confirming the fix shipped with the upstream 6.2.19 release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:94ec6d59-0abf-57db-bf8d-b06b719fc178", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 does not affect Spring Framework 6.2.19-tuxcare.3. The vulnerability allowed DoS via unbounded observation metadata allocation when processing arbitrary HTTP method names. The upstream fix (commit c18784678df) was already included in the Spring Framework 6.2.19 release that TuxCare onboarded. Both affected files contain the defense: HTTP method validation against a known set, ret...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:58d23017-f161-5a8e-a27f-786c87115e57", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. Spring Framework 6.2.19 is NOT affected by CVE-2024-38816. The path traversal vulnerability in PathResourceLookupFunction was fixed by upstream Spring Framework developers before the 6.2.19 release. The target version uses a refactored architecture where PathResourceLookupFunction delegates all path validation to ResourceHandlerUtils, which contains comprehensive defenses against path traversal: normalizeInputPath() removes backslashes/duplicate slashes/control chars, shouldIgnoreInputPath() rejects paths with \"../\" patterns (including URL-encoded variants), and isResourceUnderLocation() validates that resolved resources remain within the configured directory. The fix commit (7d3a3d35ce by rossen.stoyanchev@broadcom.com) is an ancestor of the TuxCare onboarding commit, confirming it shipped in the upstream release.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:5efc8b61-38a7-5351-af73-12feddaf60b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38819 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. CVE-2024-38819 path traversal vulnerability is NOT present in Spring Framework 6.2.19-tuxcare.3. The upstream fix (commit 7d3a3d35 by rossen.stoyanchev@broadcom.com) was already included in the upstream 6.2.19 release that TuxCare onboarded. The fix adds double URL-decoding in ResourceHandlerUtils.isInvalidEncodedPath() to detect encoded traversal sequences like %2E%2E%2F or %252E%252E%252F before they can bypass validation. Both WebMvc.fn and WebFlux.fn functional frameworks use this shared validation logic via ResourceHandlerUtils.shouldIgnoreInputPath(), providing comprehensive protection against the attack vector.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.14; >= 6.1.0, < 6.1.14; <= 5.3.40; <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.0.0, <= 6.0.24), cve.org (>= 5.3.0, <= 5.3.40; >= 6.0.0, <= 6.0.24; >= 6.1.0, <= 6.1.13), Snyk (< 6.1.14; < 6.1.14).", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:21577f59-21fb-5fc3-a1ab-4bb17b95732a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. Version 6.2.19 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:4f0d3c6a-c1ef-5214-93b4-c524e4124c84", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41242 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.19 is not affected by CVE-2025-41242. The upstream release (June 8, 2026) already includes both critical fixes: (1) case-insensitive WEB-INF/META-INF path filtering to prevent case-variant bypass attacks, and (2) refined URI decoding with better validation of percent-encoded sequences. These fixes were authored by upstream Spring developers and shipped before TuxCare onboar...", "justification": "code_not_present" } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:d1d25023-8dac-56f4-9c32-645863fcd36d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22735 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 The target repository (Spring Framework 6.2.19-tuxcare.3) is not vulnerable to CVE-2026-22735. The fix for SSE stream corruption was already included in the upstream Spring Framework 6.2.19 release that TuxCare onboarded. All three affected files (ServerSentEvent.java, SseEmitter.java, ServerSentEventHttpMessageWriter.java) contain the complete fix: validation that rejects newline characters in...", "justification": "code_not_present" } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:4cfa8078-0cdb-5e2f-9181-93013aab9d58", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22737 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2026-22737 (path traversal in ScriptTemplateView) is NOT present in Spring Framework 6.2.19. The vulnerability allowed attackers to access files outside configured template directories via path traversal in template view names. The upstream fix (commits de6601fdac and 317a1f9909 by S\u00e9bastien Deleuze) was already included in the upstream Spring Framework 6.2.19 release, which TuxCare onboard...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:9dd51640-66aa-5f46-9e9d-bda7f8fa652b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22741 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. already_fixed \u2014 Target repository version 6.2.19 already contains the upstream fix (commit 46867fad81) that prevents cache collisions in CachingResourceResolver by including resource locations in cache key generation.", "justification": "code_not_present" } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:860d6ec4-d9d0-5816-a05d-caf5e75c1c6b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22745 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. already_fixed \u2014 CVE-2026-22745 has already been fixed in Spring Framework 6.2.19. The fix (commit 684b1e8a4b) adds a file.exists() check before file.canRead() in FileSystemResource.isReadable() to prevent expensive file system operations on non-existent files on Windows, which was causing DoS attacks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:a88e9155-d497-56d8-b778-b173fd464dc4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41841 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.19 is not affected by CVE-2026-41841 (cache collision vulnerability in CachingResourceResolver). The fix was included in the upstream Spring Framework 6.2.19 release, authored by Brian Clozel from the Spring team. Both CachingResourceResolver classes (spring-webmvc and spring-webflux) correctly implement the fix by including the resource locations list in cache key generati..." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:0cf42a9c-01ec-5a48-9820-617173725e07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41842 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:f0f7a4a8-ae96-5b67-adea-c335ff369d53", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41843 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:0983e005-a665-5de4-ba81-601a02c72bef", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41844 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:25cd4e26-3bac-583e-967b-c09cf230bf72", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41845 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:865ddd52-144c-595c-b38c-a7b9a6e36cc6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41846 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:13bcd31f-0901-5d27-b32a-53abea09766d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc. The affected range ends at 6.2.18; Spring Framework 6.2.19 is not affected." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:c9eb7d61-7ee2-5e2f-b81e-4a0a5b68f38a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:7288e537-97f3-52eb-86dd-5b411d801131", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:beef7e2f-4591-551f-a3a1-8b9c1288e114", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:60fc0707-8cb5-5508-ae6a-94cacd507c23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ], "bom-ref": "urn:uuid:d88dc78b-1373-5293-aa70-d20dc37ef73b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.19-tuxcare.3 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.19-tuxcare.3" } ] }