{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:545a262c-7929-5fae-82b0-da9c3cde0400", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13", "version": "3.0.5.RELEASE-tuxcare.13", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE", "type": "library", "group": "org.springframework", "version": "3.0.5.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:69ec50f2-eed8-5ad4-90aa-f898ae117f78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f5e9549c-aa4e-5972-bb34-e5449777b14c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2011-2730 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:6118f138-d941-5ae8-90be-c77f5b0cadeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2011-2894 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:cc27e77a-3c5c-51c2-bbdc-332af1107389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-6429 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:1db4fd9b-4837-500e-8e24-6ec323021b3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2013-6430 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:8e62baca-bf51-5047-ba4e-7b44ac603e50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2014-3578 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:d32ee3fd-f1cc-52aa-97c5-facac58a4204", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:a3805e88-83ef-5030-a141-0e34518a2b96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:a5cdf951-b9d8-51f7-8f61-6c7032246c67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:d8b0a595-c9e6-55c8-968f-a19c734b046e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:4a8d448a-af90-5bcf-840e-e8a728d804d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:06bd57ec-b219-5cad-8091-a0e6ad31ae90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11039 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f4d32f75-64ee-5fac-ac29-908a0246663f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-11040 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. The vulnerable automatic JSONP handling in MappingJackson2JsonView was introduced in Spring Framework 4.1 and is not present in Spring Framework 3.0.5.RELEASE.", "justification": "code_not_present" } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:fc622b95-7c3f-593c-8067-89853f72d060", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:d33e2dd4-6b4f-58b5-841b-8789c7a07e69", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the spring-messaging module, which was introduced in Spring Framework 4.0 (released December 2013). The vulnerable classes DefaultSubscriptionRegistry and SimpleBrokerMessageHandler, along with STOMP over WebSocket functionality, do not exist in this version. CVE-2018-1257 specifically affects the spring-messaging module's handling of STOMP subscr...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:787cb5f6-d4e5-5e50-90d0-0505a730038d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-1270", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c22b12d4-3752-5a3f-9aca-0c1959066bf3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1270 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. Spring Framework 3.0.5.RELEASE is not affected by CVE-2018-1270. The vulnerability requires the spring-messaging module with STOMP over WebSocket support, which was introduced in Spring Framework 4.0 (December 2013). Spring Framework 3.0.5 (released December 2010) predates this feature and does not contain the vulnerable component (DefaultSubscriptionRegistry) or any STOMP/WebSocket infrastructure. The attack vector\u2014STOMP messages with malicious SpEL expressions in selector headers\u2014cannot be received by this version.", "justification": "code_not_present" } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:19e6d497-45dc-559f-8e5e-005e2f83258b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:95690bdf-797d-5578-ada3-194c36a1bad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:2f4aead6-d6fc-530c-a91c-ce1be70358ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:90ae6bb8-f73b-5973-ab18-e532bda88bb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:b39241d4-0017-5edf-a7c4-b095dffc1b58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c15a880b-44bc-50f4-832f-dcc481dac021", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c61167dd-617b-55f4-80f4-34e04cc28219", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. Spring Framework 3.0.5.RELEASE is not affected by CVE-2021-22118. The vulnerability specifically targets WebFlux multipart readers, including SynchronossPartHttpMessageReader and DefaultPartHttpMessageReader, which do not exist in version 3.0.5. Although Spring Framework 3.0.5 includes Spring MVC multipart handling, it uses a separate Commons FileUpload-based implementation and does not contain the vulnerable reactive multipart workflow" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:076cdf04-5d7f-559c-9c01-64871fae79b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:cc4f7b83-941a-5b6a-ad5b-e85c1de06541", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:0535aa3e-ed9f-594e-b843-bc6a90737d49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:ea5edff6-709c-5d65-8b95-51d67e6d7719", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c5bc01f0-8a94-53b8-a5a2-7cf2a93f72db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:0bb8488d-7988-513e-8244-9d6fd1085cac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:758b6a8b-157e-5582-bea8-d2d9f799b272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:9b007b17-2449-5586-9304-75e6a47fdc44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22243 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 3.0.5.RELEASE is not affected by CVE-2024-22243. The vulnerability specifically targets UriComponentsBuilder, a class that does not exist in version 3.0.5 (introduced in Spring 3.1+). While Spring 3.0.5 contains URL handling utilities (UriUtils, UriTemplate), these do not provide the component extraction and builder pattern functionality required for the vulnerability to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:0a5f6a99-2a0d-5eda-9fb8-ca47c2cb789b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22259 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. Spring Framework 3.0.5.RELEASE is not affected by CVE-2024-22259. The vulnerability specifically targets `UriComponentsBuilder`, a class that does not exist in version 3.0.5 (it was introduced in Spring Framework 3.1). Although Spring 3.0.5 includes URL handling utilities such as `UriUtils` and `UriTemplate`, they do not implement the component extraction and builder functionality required for the vulnerability to manifest" } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:3bac02a5-7602-57a0-87fc-1f20b0e7a19d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-22262 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. Spring Framework 3.0.5.RELEASE is not affected by CVE-2024-22262. The vulnerability specifically targets `UriComponentsBuilder`, a class that does not exist in version 3.0.5 (it was introduced in Spring Framework 3.1). Although Spring Framework 3.0.5 includes URL handling utilities such as `UriUtils` and `UriTemplate`, they do not implement the parsed-host inspection and builder workflow required for the vulnerable parse-validate-use scenario" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:dcb1febd-dc63-5bca-aded-247598a2e165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c97e1cb3-300b-513f-8d4e-0ebb1c4a0fa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:d21d7ef7-0196-5aec-944d-72fc0c98e5b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:15ba4391-3a25-5ef4-b343-daf5d2b96aa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:c5fbf807-b61b-599c-8b5a-a1b0d0c6b023", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework version 3.0.5.RELEASE is not affected by CVE-2025-41234. The vulnerability requires the org.springframework.http.ContentDisposition class and its Builder.filename(String, Charset) method with non-ASCII charset support. Version 3.0.5 predates the introduction of the ContentDisposition class (added in Spring Framework 5.x era around 2017-2018) and has no RFC 2231 encoding support...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:165b8acb-de9e-5667-bf0d-d7c598c900bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:bc6b0e99-9770-55bb-ad52-3b0f1e16c679", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:08375bb2-5420-580c-b796-718bd87570b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:5f2aa1e8-98cf-5b93-8f56-8e56a7477bee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:0eab4af3-1f15-5378-8a83-c255bf71127e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:779ee1dd-f818-5f58-b046-7588e0f36b01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:45993590-ba0d-5733-8cd5-6f0c0f782629", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41851 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 The target repository is Spring Framework 3.0.5.RELEASE-tuxcare.6, which is outside the affected version range for CVE-2026-41851 (affects 5.3.0+, 6.x, 7.x). The specific vulnerability pattern 'unbounded cache growth' cannot manifest because this version lacks the pattern caching mechanism entirely - it compiles regex patterns on every match without caching. The vulnerability chain is broken at...", "justification": "code_not_present" } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:97c2fe66-0dc1-5e3f-a873-df63ec9668bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:d726e68f-7cce-5c27-b695-ef2d472e923b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 3.0.5.RELEASE is not affected by CVE-2026-41854. The vulnerable component (UriComponentsBuilder with RfcUriParser) does not exist in this version. Version 3.0.5 predates RFC-compliant IPv6 URI parsing - it uses a primitive regex-based parser in UriUtils that cannot correctly handle IPv6 bracket notation. While the regex can receive IPv6 URLs, it extracts invalid components (e.g...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:fe173764-138f-5911-9a89-9314f2cfaa44", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 3.0.5.RELEASE predates Spring WebFlux (introduced in 5.0) and does not contain the PartEventHttpMessageReader class or reactive multipart handling with Flux. The vulnerability specifically affects PartEventHttpMessageReader's maxPartSize enforcement when maxInMemorySize is -1. Spring 3.0.5 uses servlet-based CommonsMultipartResolver which has a different architecture...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:31d6cee8-7afa-56ba-964a-6e66f09ed28e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:6bb7161c-e600-5caa-88ce-b4021f8ef9c0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web. not_affected \u2014 Spring Framework 3.0.5.RELEASE does not contain the vulnerable component. CVE-2026-47889 affects WebFlux applications using the Jetty 12 Core reactive adapter, specifically the JettyCoreServerHttpResponse class that incorrectly returns null for the sameSite cookie attribute. WebFlux (Spring's reactive web framework) was introduced in Spring Framework 5.0 (2017), while the target version 3.0.5 w...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:1195268e-294f-55e8-a51b-2797e61bbade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:f41c3ec6-6bf5-5d24-802a-a623708e78c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:bc2366ac-108b-50ea-80cc-996095b29cab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ], "bom-ref": "urn:uuid:6848035d-94bf-5c44-8edb-d8177c5489ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 3.0.5.RELEASE-tuxcare.13 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@3.0.5.RELEASE-tuxcare.13" } ] }