{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2f40d713-f7fb-5cdf-b2ab-310d397262c3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2", "version": "5.2.15.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.15.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06d54e66-6ae4-50bd-9afc-9f8434aec4f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c8d4e20b-6d68-506e-945c-52eab44ed261", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7f9adc3-c987-5765-9ee3-085e922c20a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d976553-4ec6-551f-aa39-0a9bbc0ce225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:657d679a-6140-5684-92c8-b324b99e6662", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:159f4b09-0ade-53ec-b93f-092761bcdbcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:84ad78e4-6bd1-5ee8-82d6-f6dfda39fda3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3f8a3207-7bfe-5606-912a-0807196b6ebd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a7193cb-0a3d-54e1-b439-a553688ad040", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c562193-bf81-5f2f-b215-35cc699add56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:caa10d12-2809-5b7b-a265-324d56a0da3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da975913-60b1-5a38-bae2-cb59879cf822", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10cde020-e1eb-5955-81a3-3714c678460b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:001f5064-901d-521f-83f4-ec5f76164a75", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a51dc4a6-ff09-51c5-a159-76fa1403d625", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9070dfd1-ff1d-54fe-9665-45873992a887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64baac56-7271-5043-b8b2-113ce310bb05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1659447-29fd-54da-9f16-a9635da74a96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4561ca53-7414-5075-8619-87edeb5080bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b03aa8e-4096-5027-b82d-79be17aa65c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b04709a5-d777-5ee6-853a-441ca74c4500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f4d898d3-ab15-517f-bb91-96bd8b7621a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web. Spring Framework 5.2.15.RELEASE contains the upstream vendor fix for CVE-2021-22118. The vulnerable pattern (predictable temporary directory paths) is not present because the code uses Files.createTempDirectory() to create random, unpredictable directory names. The fix was authored by upstream Spring Framework (apoutsma@pivotal.io) and is part of the v5.2.15.RELEASE tag. Note: DefaultPartHttpMessageReader does not exist in 5.2.x series (introduced in 5.3.0), so only SynchronossPartHttpMessageReader required fixing in this version.", "justification": "code_not_present" } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:85a41021-d7aa-5054-b25a-564912152035", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:92562abd-c976-594f-81f2-044ed98c4c06", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:524172fe-89a5-5617-b917-b7c5f2772080", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29f7eeeb-cdc8-5b99-9e9f-adb1fecbabf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96ce3d24-6771-5239-9521-f99f344c102e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:732ead1d-71eb-53c0-9548-b2729791534e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ef8c8fb3-3cc9-58aa-9c44-19bf18d330c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1e67b68e-a866-5264-8c8a-f4a2bfeb57b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4e71c24-4a80-5fb2-bfcc-a08a26c9e07c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d45ef25b-397a-5255-b733-9e88c45bda9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:878afae0-b208-5b51-ae7d-c8e4ee965952", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e6573628-406b-51a0-a34d-e6a36542005d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:082ac188-15a1-5b05-9b20-b7d1ef876742", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7926b0f0-8f7c-592e-969c-1957382105df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.15.RELEASE is not affected by CVE-2026-47885. The vulnerable class PartEventHttpMessageReader and the PartEvent API were introduced in Spring Framework 6.0.0, which is significantly newer than the target version. The target uses a different multipart handling implementation (SynchronossPartHttpMessageReader) that does not have a maxPartSize configuration, making the vulnera...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9832a149-890e-5037-ab58-8e3398dbc0ac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.15.RELEASE does not contain the vulnerable component JettyCoreServerHttpResponse. This class was introduced in version 6.2.0-M5 (January 2024) as part of Jetty 12 Core reactive adapter support. The target version uses the older servlet-based Jetty adapter (JettyHttpHandlerAdapter extending ServletServerHttpResponse) which correctly serializes response cookies including the ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:67be8dda-6bc1-5b03-8ef8-9f2191819bb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ef64c7b8-9fbc-5899-baa6-6063f4c41b41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53406668-6798-55d6-aa50-dba016325b94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.15.RELEASE-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.15.RELEASE-tuxcare.2" } ] }