{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a84ddb69-397a-5b20-ad97-8366eb1841eb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:42084560-faf4-56e9-8e21-7ca680f5164f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac8fc8e8-4524-5f81-9e11-fba1ade9b089", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:beae615d-ba1d-5a8b-b3d1-be8f0a1a3430", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24f55db1-3453-5c79-9e85-5c8a86953e3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:75c48cf6-8fd6-5887-be2d-ba47f71684ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:31f33d99-9ae5-5f8b-ac93-39624545acc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:01a6f5c9-3529-556b-a215-a77c25220358", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:560cc808-8a69-5b5f-b11f-ee298e1de17a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:343704fc-05c2-512c-8656-dc210b04874a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60193ba5-030b-5c7f-82f3-28acc10c22c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fde9639-b405-5a57-beb1-f56b61749f80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a96922f-a145-5257-9255-6e1a4ea81077", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c45eb79f-3fde-581f-8581-ea35a653c668", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d14863f4-7bbd-51c9-b193-f6c1251d62cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dba7bfbb-9425-5e13-bb59-63d0f7267763", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ac09c92-100d-5794-96ba-dd65a3111eb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:170a7f92-6696-5783-b0c2-b1e528e3fafb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5b5646c-d4d1-500d-ba2c-f471a84eda89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8011b6d7-b36a-5a6e-bc46-82b546b9bf31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5141d921-ab30-583c-8105-9332a8d5470a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c7f1c00-b323-550c-b28b-7e2b3600eefb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd62ac16-bcf9-557d-9788-19cfb88d999a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4f48ddf-ee76-5313-9556-428e0a5bb38c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:833dee29-d851-50bb-bc66-5ceb95b58306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b28449cc-49bb-5653-859b-3bdf5fdc6db2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:02cc51be-cee6-546a-be79-738b58d324f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ceaaa60-928b-54dd-a762-3e046bcfbfed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d730122-d5bc-521b-abac-122cee62cdc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6bd289bb-c2b7-513e-8a84-a6ff06d11fb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab45802d-4f0b-58f3-926b-10358db9282d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04331151-f5a0-5258-8f96-befba369c3c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.10.RELEASE is not affected by CVE-2025-41234. The vulnerability involves unencoded double-quote characters in a quoted-printable encoded filename parameter when using non-ASCII charsets. This vulnerable feature (dual-parameter output with quoted-printable encoding) was introduced in Spring Framework 6.0.10 (February 2023), after the target version 5.2.10.RELEASE (2020). The...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:41553afc-a5ed-50fd-8637-aef70336d5aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1297a7c1-6817-5176-96ab-66d1a3800245", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:891a338c-b1d1-5ed3-bd3b-beba986c4199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:50e64472-3329-5e4a-86e9-d289b10e7bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:38f02409-1ea3-52a0-b39e-0929bb2732f9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47885. The vulnerable component PartEventHttpMessageReader does not exist in this version. The PartEvent API and PartEventHttpMessageReader class were introduced in commit be7fa3aaa8 on 2022-02-10, approximately 1.5 years after the 5.2.10.RELEASE tag (2020-10-27). The target repository uses SynchronossPartHttpMessageReader for multipar...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc41d777-a994-51d4-bd12-797f7a08ba32", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47889. The vulnerability specifically affects the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in this version. Spring 5.2.10 uses a Servlet-based Jetty integration (ServletServerHttpResponse) that properly serializes the sameSite cookie attribute through ResponseCookie.toString(). The CVE wa...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9deb8ba-6620-5cf9-9448-8639d052fe2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f56c4e1-3f2a-5a04-9da9-6193987dc766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:714a116c-e84e-5d2e-8526-a51f7e18e46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ] }