{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:df051f87-10bf-5b74-a067-d97f21e25c5e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5", "version": "6.2.5-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.5", "type": "library", "group": "org.springframework", "version": "6.2.5" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:3501bd2c-f084-5c3f-98e2-948b4ef3d28b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 XXE vulnerability is NOT present in Spring Framework 6.2.5. The fix (disabling external entity resolution by default) was included in the upstream Spring Framework release and was already present when TuxCare onboarded version 6.2.5. The target contains the defense: processExternalEntities field defaults to false, SAX feature \"external-general-entities\" is disabled, and a NO_OP_EN...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:c1b6e7d0-34f7-55f4-b598-5539a38da7a2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. CVE-2014-0225 concerns an XXE (XML External Entity) vulnerability in Spring Framework where XML parsers did not disable external entity resolution by default, allowing attackers to read arbitrary files or make network requests via malicious DTD declarations. The upstream fix (commit 8e096aeef5 by rstoyanchev@gopivotal.com) was already present in Spring Framework 6.2.5 before TuxCare onboarding. The fix installs NO_OP entity resolvers and disables external entity processing by default across all XML parsing entry points (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, and StaxUtils). Verification confirms processExternalEntities defaults to false, NO_OP resolvers are active, and additional protections like disallow-doctype-decl are enabled. The vulnerable pattern (allowing external entity resolution) is not present in this version.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:3ff17002-afe0-5cf5-9ebb-239ffa0467ae", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability in Spring MVC FormTag's default action is NOT present in Spring Framework 6.2.5. The upstream fix (commit 741b4b229a by Rossen Stoyanchev) that adds URI path encoding to prevent XSS was already included in Spring Framework 6.2.5 before TuxCare onboarded it. The vulnerable pattern (unencoded request URI in form action attribute) has been removed by the upstream ve...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:12dd8bcd-6359-5c06-88d2-89183dd3e66a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 6.2.5 is not affected by CVE-2014-3625. The directory traversal vulnerability in static resource handling was fixed by the upstream Spring project in November 2014 (commit 9cef8e3001ddd61c734281a7556efd84b6cc2755, SPR-12354) and shipped in Spring Framework 3.2.12, 4.0.8, and 4.1.2. All subsequent versions, including 6.2.5 released in March 2025, contain the complete fix. The ta...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:751a8f3f-3966-5f9e-b4b7-491aeed20bb7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.5 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1a1e18c2-ac4f-5424-adda-8da63da74880", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2020-5397 affects Spring Framework versions 5.2.x prior to 5.2.3, vulnerable to CSRF attacks through CORS preflight requests lacking proper Origin header validation. The target repository at version 6.2.5-tuxcare.4 contains the complete upstream fix (commit bc7d010485) that shipped in upstream release 6.2.5. All fix components verified: CorsUtils.java files check Origin header presence (ser...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:cfe44206-1e3d-5614-bbed-f07fa9f5fec3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download via unescaped quotes in Content-Disposition filename) is NOT present in Spring Framework 6.2.5-tuxcare.4. The vulnerability was fixed in the upstream Spring Framework release (commit 41f40c6c, Dec 2019) BEFORE TuxCare onboarded version 6.2.5. The target contains comprehensive quote-escaping defenses on all code paths: ASCII filenames use appendName() which escapes quotes with backslashes (ContentDisposition.java:624-626), and non-ASCII filenames use encodeQuotedPrintableFilename() which hex-encodes quotes (PRINTABLE.set(34, false) at line 71). Both defenses prevent attacker-controlled quote characters from breaking out of the quoted-string parameter value in the Content-Disposition header.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:6f5d4d51-42a3-5d21-a1dd-d576ffcd64df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. Spring Framework 6.2.5 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:548e7ab4-a71a-5de4-ac8c-d815d5a8a0a9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. CVE-2023-20860 is NOT present in Spring Framework 6.2.5. The vulnerability involves a pattern matching mismatch between Spring Security and Spring MVC when using \"**\" patterns with mvcRequestMatcher, potentially allowing security bypass. The fix (pattern normalization by prepending \"/\" to patterns without leading slash) was implemented by upstream Spring Framework developer rstoyanchev@vmware.com in commit 20afa3265a (July 2023) and shipped in the upstream 6.2.5 release. The target version contains this fix via PathPatternParser.initFullPathPattern() method, ensuring consistent pattern interpretation.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:adfdde45-9206-5ffb-a11c-7fd1700888ca", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 is not present in spring-framework 6.2.5-tuxcare.4. The vulnerability affects Spring Framework 6.0.0-6.0.13 and allows DoS through unbounded memory allocation via arbitrary HTTP method names in observation metrics. The upstream fix (commit c18784678d by Brian Clozel) was already present in the upstream 6.2.5 release before TuxCare onboarding. Both DefaultServerRequestObservationC...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:135b834a-902c-5efc-9592-e2496f6c4579", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. The target Spring Framework 6.2.5-tuxcare.4 is NOT AFFECTED by CVE-2024-38816. The vulnerability fix (commit d86bf8b2) was authored by the upstream vendor (Rossen Stoyanchev at Broadcom) and was already included in the upstream Spring Framework 6.2.5 release before TuxCare onboarded it (first TuxCare commit a47acaade5). The vulnerable code pattern does not exist in the target because the upstream vendor removed it prior to the 6.2.5 release. Both WebMVC and WebFlux PathResourceLookupFunction classes use ResourceHandlerUtils utility methods that implement all the security validations from the CVE fix: path normalization, URL-encoded path validation, and traversal pattern detection.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:c4e0d838-450a-562f-a1d1-691494cff759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:49047751-def9-5f9b-bcde-755cbc2868be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc. Version 6.2.5 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:4d46a3ff-491e-592d-8056-a62fd7f53ed2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:e2735945-d613-5052-890a-133a8175a52a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:101dabd5-8227-590d-9b9c-6fe056bdbd3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:773e00ca-c9cc-5251-a78a-54c54602876a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:ffaf4181-7975-5495-86e9-b6a595e16e96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:71c9aa07-f6b5-58d2-8993-1f88e4bcd2a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:696d127c-dee6-52e5-9838-da7e32744e11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:751f6667-e6c0-5349-a33e-857d9789bcfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:cd72b993-0126-5190-be14-d16b2c804c28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:68a8c189-1d2f-5d17-a22a-21ff5d0c5194", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:be35324c-550f-5b5d-ad22-dfe9fe4f5a47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:a7d46747-baa0-5411-b34c-6f9c926736d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:c167f4c6-ea53-53d0-8f2d-c55f45160a08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:b6b218d6-311e-550d-9cb3-39dcc699ca91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:dda4e2c3-8c0c-5eb4-afb0-0aa278ea47f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:1dc1ef88-d1cf-52cc-ad6c-5313042a973e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ], "bom-ref": "urn:uuid:0f2ca4f4-d424-5de4-92df-647e8b3ddd84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.5-tuxcare.5 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.5-tuxcare.5" } ] }