{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:bd49da5e-2772-5e91-83f5-b9aa8102dadc", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1", "version": "5.3.18-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.18", "type": "library", "group": "org.springframework", "version": "5.3.18" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:d6b03f0e-e087-525d-ba4d-f5c15ce49956", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:525ad43c-007f-5f08-ab18-b270e4563d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:28e8dc8f-fb53-5c11-a077-5248d61a7a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8fa837f0-98e1-5c2c-8cda-aa0c46417681", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:0fb35ac9-ecd9-506e-b639-099579f41c23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a69ccedc-55ee-5e09-a3c3-f8d3b5104237", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:29b71ddc-b23b-515c-a665-c43d98b24121", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:b545cbff-685c-5e62-ae71-e4db75847b4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:595ff96a-5fdb-5677-a7c2-0a2230aa2cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c702f8fc-43e0-5e6c-a428-ffadaba4486c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ed8827fb-7b1a-5dcd-849a-a140079eb95a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f3c2a62b-a38d-5f10-8d0e-6f5cb83d7350", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:82871fb9-ba78-57a5-9cd1-cbb891ca6d47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:1242985a-9bd9-5e6d-9cf7-9695b3d45b21", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:505abdbf-8f41-5a39-a0d3-30990235c0ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:c17eacf9-8f31-5a19-8b6e-ddc1e90aedd4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:ef08575d-5fc5-5635-a2c8-de1c182a3426", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6c4e7424-56dc-5367-ac6d-afb9d4086ef8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:84794096-8ab3-551e-86da-1368c4ba2cff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:47139841-8747-5aa8-a603-c2994f62616c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:49f273bc-0aa0-5ed4-b024-12185dc625a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7d5c7ab8-0bbf-518a-9b3b-6f39bb955c57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:5c59de0c-9ffa-5c28-a2e6-79ea687d6f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:63962582-c060-5622-8457-091076f2c4a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:6d6e5e73-3c68-59d2-8d93-2dc9c05a9507", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:a6d082d6-0314-5914-9048-a3a655d40099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:fe82d481-269f-5e95-bcaa-d1020300b5bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8412919d-6b06-56d0-9fd8-3b2e804e3f1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:832f496b-c0f0-5955-9db3-3adfed57ce47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:195d34b8-361f-5f5c-ab15-040ec0c88e3c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Target Spring Framework 5.3.18 is not affected by CVE-2024-38820. This CVE specifically addresses locale-dependent toLowerCase() behavior in DataBinder's field restriction logic\u2014a vulnerability introduced by the fix for CVE-2022-22968. The target version predates that fix and does not use toLowerCase() at all in setDisallowedFields or isAllowed methods. The vulnerable code pattern (toLowerCase(...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:7ba1fc70-f2d7-5f5c-b40b-b71a6f95e156", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework v5.3.18 is NOT affected by CVE-2025-41234. The vulnerability requires quoted-printable encoding of filenames with non-ASCII charset, a feature introduced in v6.0.10 (commit 58fbf60d2d, Feb 2023). Version 5.3.18 (March 2022) only uses RFC 5987 encoding (filename* parameter) for non-ASCII charsets, which automatically percent-encodes all header-breaking characters including doubl...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:f5f02670-ec7e-5b7d-bb9c-bce0f7462338", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:012a47b2-bde1-5da3-8f3f-2e24e9d5104e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:79c0f51f-6a97-5568-959b-154aa072030e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:24ad445f-951c-5b18-bcc6-7a98685cbdcb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:4871e8a9-fb1e-50f5-947c-b8fc1a20ab38", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.18 is not affected by CVE-2026-47885. The vulnerable class PartEventHttpMessageReader and its maxPartSize property do not exist in this version. They were introduced in version 6.0.0-M4 (February 2022). The target uses different multipart readers (DefaultPartHttpMessageReader, SynchronossPartHttpMessageReader) that lack the maxPartSize configuration property entirely, makin...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:b9d31bda-60c6-5468-85b9-4a864507bb33", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.18-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.18 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class) which does not exist in this version. Spring 5.3.x uses servlet-based Jetty adapters (Jetty 9/10 via ServletHttpHandlerAdapter) that correctly serialize the sameSite cookie attribute. Jetty 12 Core support was introduced in Spring Fra...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:8274a3fb-625e-5a1d-b877-bd51b0eea609", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:12cfea34-4a79-5927-a561-969e2563369b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ], "bom-ref": "urn:uuid:57e35089-35b7-58a5-bdbb-cb367c795ee0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.18-tuxcare.1 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.18-tuxcare.1" } ] }