{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8e7146a2-6a21-5bc7-bf74-f617f95f4bc7", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2", "version": "6.2.7-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.7", "type": "library", "group": "org.springframework", "version": "6.2.7" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:4b02137b-f2af-52e3-9f37-ad4cd8429522", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 affects Spring Framework versions before 3.2.8 and 4.0.0 before 4.0.2 due to XML External Entity (XXE) vulnerability in Jaxb2RootElementHttpMessageConverter. The target repository (spring-framework 6.2.7-tuxcare.2) is NOT AFFECTED because the upstream vendor fix from February 2014 (commit edba32b3093) is present in the codebase. The fix disables external entity resolution by defau...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:9e2658bb-cdf6-5e85-823b-88760c3c36a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0225 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. CVE-2014-0225 (XXE via DTD declaration) is NOT present in Spring Framework 6.2.7. The fix was already included in the upstream Spring Framework 6.2.7 release before TuxCare onboarded it. All affected XML parsing components (SourceHttpMessageConverter, Jaxb2RootElementHttpMessageConverter, Jaxb2CollectionHttpMessageConverter, Jaxb2Marshaller, AbstractMarshaller) have XXE protections via NO_OP_ENTITY_RESOLVER and NO_OP_XML_RESOLVER that return empty content, preventing external entity resolution in DTD declarations.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 4.0.0, < 4.0.5; >= 3.0.0, < 3.2.8), NVD (= 3.0.0; = 3.1.0; = 3.2.0; = 4.0.0; = 3.0.1; = 3.0.2; = 3.0.3; = 3.0.4; = 3.0.5; = 3.0.6; = 3.0.7; = 3.1.0-rc1; = 3.1.0-rc2; = 3.1.1; = 3.1.2; = 3.1.3; = 3.1.4; = 3.2.0-rc1; = 3.2.0-rc2; = 3.2.0-rc2-a; = 3.2.1; = 3.2.2; = 3.2.3; = 3.2.4; = 3.2.5; = 3.2.6; = 3.2.7; = 3.2.8; = 4.0.0-rc1; = 4.0.0-rc2; = 4.0.1; = 4.0.2; = 4.0.3; = 4.0.4), cve.org (>= 4.0.0, <= 4.0.4; >= 3.0.0, <= 3.2.8; < 3.0.0), Snyk (>= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE; >= 3.0.0.RELEASE, < 3.2.9.RELEASE; >= 4.0.0.RELEASE, < 4.0.5.RELEASE).", "justification": "code_not_present" } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a5298448-75cb-5239-86ae-1eb8fff7b9c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-1904 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-1904 XSS vulnerability is NOT present in Spring Framework 6.2.7. The vulnerability involved unencoded URI injection into the form action attribute in FormTag.java. The upstream fix (URI path encoding via UriUtils.encodePath) was already included in Spring Framework 6.2.7 when TuxCare onboarded this version. The fix commit 741b4b229a by upstream author rstoyanchev@gopivotal.com is an an...", "justification": "code_not_present" } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:521d2426-b005-5c9e-8c52-58320e2badee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-3625 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-3625 is a directory traversal vulnerability in Spring Framework's static resource handling that allows reading arbitrary files via crafted paths. The target (Spring Framework 6.2.7-tuxcare.2) is NOT AFFECTED because the comprehensive fix from upstream commit 9cef8e3001 (SPR-12354) was already present in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. The fix, author...", "justification": "code_not_present" } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a893efe2-5a20-52bf-9e92-b1a4fd914a2c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. CVE-2016-9878 is a path traversal in ResourceServlet. ResourceServlet was deprecated in 4.3 and removed in Spring Framework 5.0, so 6.2.7 does not contain the vulnerable code.", "justification": "code_not_present" } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:74ef5b86-7ffb-51d1-9956-cacc2b76a3f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5397 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.2.7-tuxcare.3 is not affected by CVE-2020-5397. The vulnerability was fixed in upstream Spring Framework commit bc7d010485 (authored by S\u00e9bastien Deleuze from Pivotal) which was already included in the upstream 6.2.7 release when TuxCare onboarded it. All three components of the fix are present: (1) CorsUtils.isPreFlightRequest() validates the Origin header, (2) Ab...", "justification": "code_not_present" } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:3bc0397e-2b11-58b7-a91b-0d1b82cec74b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5398 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. CVE-2020-5398 (Reflected File Download via Content-Disposition header injection) is NOT present in Spring Framework 6.2.7-tuxcare.3. The vulnerability was fixed in the upstream Spring Framework release before TuxCare onboarded version 6.2.7. The original fix (commit 41f40c6c from December 2019) added quote escaping to prevent header injection attacks. The current code contains the defense via the appendName() method (lines 616-630 in ContentDisposition.java), which escapes quote and backslash characters before inserting user-supplied filenames into Content-Disposition headers, preventing attackers from breaking out of quoted values to inject arbitrary header content.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE; >= 5.2.0.RELEASE, < 5.2.3.RELEASE; >= 5.1.0.RELEASE, < 5.1.13.RELEASE; >= 5.0.0.RELEASE, < 5.0.16.RELEASE), NVD (>= 5.0.0, < 5.0.16; >= 5.1.0, < 5.1.13; >= 5.2.0, < 5.2.3), cve.org (>= 5.0, < 5.0.16.RELEASE; >= 5.1, < 5.1.13.RELEASE; >= 5.2, < 5.2.3.RELEASE), Snyk (>= 5.2.0, < 5.2.3; >= 5.1.0, < 5.1.13; >= 5.0.0, < 5.0.16; <= 0; <= 0).", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:d12b26a2-4a4c-517f-b329-b291eb43d237", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 6.2.7 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6de3eb3a-c6fd-5994-ab0c-5579183c791c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20860 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. Target Spring Framework 6.2.7-tuxcare.3 is NOT affected by CVE-2023-20860. The vulnerability (pattern matching mismatch between Spring Security and Spring MVC when using patterns like \"**\" without leading \"/\") was fixed in upstream Spring Framework commit 202fa5cdb3 (March 2023) by rstoyanchev@vmware.com. This fix shipped in the upstream 6.2.7 release (May 2025), which TuxCare onboarded. The defense normalizes patterns by prepending \"/\" to patterns lacking a leading separator via PathPatternParser.initFullPathPattern(), called from LookupPathMatchableHandlerMapping.match(). All code paths through getMatchableHandlerMapping() apply this normalization wrapper, preventing the authorization bypass.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.0.0, < 6.0.7; >= 5.3.0, < 5.3.26), NVD (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7), cve.org (>= 6.0.0, <= 6.0.6; >= 5.3.0, <= 5.3.25), Snyk (>= 5.3.0, < 5.3.26; >= 6.0.0, < 6.0.7).", "justification": "code_not_present" } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:aedbb62b-43a4-5431-b001-3daeb6891ab6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-34053 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2023-34053 is NOT present in Spring Framework 6.2.7-tuxcare.3. The vulnerability involves excessive KeyValue object allocations during HTTP request observation recording when arbitrary/non-standard HTTP method names are used, leading to memory exhaustion and DoS. The upstream fix (commit c18784678d by bclozel@vmware.com) was already present in the Spring Framework 6.2.7 release that TuxCare...", "justification": "code_not_present" } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:52f21cf7-54ad-5ff5-98c7-a80622870640", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38816 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. CVE-2024-38816 path traversal vulnerability is NOT present in Spring Framework 6.2.7-tuxcare.3. The upstream security fix (commit d86bf8b2056429edf5494456cffcb2b243331c49) was already included in the upstream Spring Framework 6.2.7 release that TuxCare onboarded. Both WebMvc.fn and WebFlux.fn RouterFunctions have proper URL-encoded path traversal validation via ResourceHandlerUtils.isInvalidEncodedPath() and isInvalidEncodedResourcePath() methods.\n\nAdvisory cross-check (dlmn): outside the affected ranges of GitHub (>= 6.1.0, < 6.1.13; >= 6.1.0, < 6.1.13; >= 6.0.0, <= 6.0.23; >= 6.0.0, <= 6.0.23; >= 5.3.0, <= 5.3.39; >= 5.3.0, <= 5.3.39), cve.org (>= 5.3.x, < 5.3.40; >= 6.0.x, < 6.0.24; >= 6.1.x, < 6.1.13; >= 5.3.0, < 5.3.40; >= 6.0.0, < 6.0.24; >= 6.1.0, < 6.1.13), Snyk (< 6.1.13; < 6.1.13).", "justification": "code_not_present" } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:0b0b0268-7299-5af6-860a-5cef8256a615", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38819 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b354348b-2ffe-5aca-a8b7-0d57ec178871", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc. Version 6.2.7 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-w3c8-7r8f-9jp8 (affected below 5.3.42), CVE record (affected below 5.3.42), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f8953e61-3ef8-546a-b811-103ec9ad199c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c8983618-a7f3-5fda-a5c4-039df5429e43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f94aeeb8-1c51-54a7-9305-488943905770", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:b26770c2-8bd6-51ac-8ba0-72651d132146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6285c1e1-2436-507b-950a-a83c3dd331b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:2326b1d7-28f1-577e-b7e3-136fae21e73e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:6555efdc-80e6-50a4-9222-490f47546719", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:f6633a83-58d8-5aee-8f44-a143bc2d7bab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:8df4c810-8c78-5bba-a8d9-dea8041631e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cdd7d6f2-3df3-5862-8112-0601fcb5a36f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:cbcc202e-ca7b-5e31-ae93-565e7e94a61b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 6.2.7-tuxcare.3." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:27b9af75-c7c4-54c4-9055-5266248f0fe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:985957e8-4a25-5a13-a184-d02b63df6fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:97b61ed1-8b53-5d84-9b38-5bb9f1f6c698", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:a0281afc-641f-561f-844d-539166dc45b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:c0236f54-5680-53e1-a610-60b8f2dfe3ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47890 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ], "bom-ref": "urn:uuid:20ca25e4-5876-5561-a859-221f971b2699", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59313 affects version 6.2.7-tuxcare.2 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.7-tuxcare.2" } ] }