{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f2ce52ec-ae19-5ab0-98f5-66cc4c19f7e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1", "version": "5.3.23-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.23", "type": "library", "group": "org.springframework", "version": "5.3.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:1543c751-6f20-5eb8-b3a1-ffbb239ccc79", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:7a40fc26-0eb5-589e-a9f0-1c8971243c68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:8f3b1591-cf0f-52c4-9291-1a9797c990f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:60b27c19-27a0-576d-82d3-414f1ce5928c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:e7884a7d-b241-5b34-b438-bfd84dead0f3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.23 is NOT affected by CVE-2013-6430. The vulnerability was fixed in Spring Framework 3.2.2 (released February 2013) by upstream commit f5c9fe69a44, which added proper escaping for angle brackets (<, >), Unicode line separator (\\u2028), and Unicode paragraph separator (\\u2029) in JavaScriptUtils.javaScriptEscape(). The target version 5.3.23 includes this fix as pa...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:e466f8ec-bfdc-5f3b-a5bc-ec8099b04517", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:f3a6e8f0-c8be-5987-aa7e-cae87da7ea56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:94b0e59c-5c41-5dbf-bdc3-cafe0d6a475c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 is NOT present in Spring Framework 5.3.23. The vulnerability was fixed by the upstream Spring project in June 2015 (commit d79ec68db4 by Rossen Stoyanchev) and included in Spring Framework 4.2.0+. The target version 5.3.23 (released in 2022) already contains this upstream fix. All XML parsers now have DTD processing disabled by default via the `disallow-doctype-decl` feature, prev...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:69dc0655-c39f-548e-bf0c-921640377105", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:7129f316-7c36-520c-9897-704024760e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:02511cc2-0ba4-520e-b0bb-5a0ec9dea60a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:fd1442b3-1ec9-532a-aeb1-6a531cfb195b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:7c4c589b-a054-5000-93ce-92f6ff83124c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:bae7e0ba-96cd-5862-8a80-b767e5bc7982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:1c006dbe-44be-5a2b-9195-8b5a7d4c1fa5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2018-1257. The vulnerability affects versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17. The target version (5.3.23, released 2022) is well beyond the fixed versions and contains the upstream fix that allows disabling selector header processing to prevent ReDoS attacks. The fix was authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) in Apri...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:7c54c0d2-ca5e-50da-ba91-1bea3026308d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:f3ab978d-be27-586e-9471-de919b1fb267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:12e8058f-8b34-5bad-9107-0b767a3bf688", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:056e2408-cd9b-5d67-bee2-ba7f4fd4acb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:6a456b23-5157-5f7b-9a21-cd430df5dbf2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:4ea9dd92-f580-5cad-9150-32f028c8d506", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:fa007cce-f6ef-5064-84ba-052fdf894535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:4755edf5-c88a-5166-94ef-3ab5b4689f67", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. Spring Framework 5.3.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:ef544315-2979-5732-9b89-f2be5eac2e3e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2022-22970 affects Spring Framework versions prior to 5.3.20+ and 5.2.22+. The target version 5.3.23 is not affected because the upstream vendor fix (commit 83186b689f by Juergen Hoeller) was included in Spring Framework v5.3.20 released in May 2022. The fix refines bean introspection to exclude dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain types) and blocks U...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:3c902bb8-cb1e-554a-8a2d-921199334d81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:2b9db930-fc28-567b-b6c6-1c3bf016c63f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:0c158934-c6f3-53b7-bcd4-b0a778b81815", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:630554a7-fc8f-573b-9a52-766e47234521", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:9f45ce30-6d98-5f17-8ced-c693d97143a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:8f09ecbf-faf0-5463-ab4e-a4ccee2f8d41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:b15a01c5-420d-5d30-ad98-5918adb0f6ee", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2025-41234. The vulnerability requires quoted-printable encoding of the filename= parameter when using non-ASCII charset, which was added to Spring Framework in commit 58fbf60d2d on Feb 1, 2023 (5 months after v5.3.23 release on Sep 15, 2022). Version 5.3.23 uses a simpler architecture: when non-ASCII charset is specified, it outputs only filename*...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:91172677-48fe-51dc-926a-f5436d619981", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:2d3b15e7-976f-5213-a0e2-b608a70544ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:2b2e0137-c067-5d28-8d9f-8b5444350772", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.23-tuxcare.1 of org.springframework:spring-web, and is fixed in 5.3.23-tuxcare.2." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:f15ef658-1317-508f-be37-c174cc8e8b47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:addddbdf-e319-5f24-ba33-096252e45992", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.23 is not affected by CVE-2026-47885. The vulnerability concerns PartEventHttpMessageReader failing to enforce maxPartSize limits when maxInMemorySize is set to -1. However, PartEventHttpMessageReader, the PartEvent API, and the maxPartSize configuration were all introduced in Spring Framework 6.0 (February 2022) and do not exist in version 5.3.23. The target version uses D...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:676a38cd-9dd7-59c6-86de-2e8b6f18b472", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.23-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.23-tuxcare.3 does not contain the vulnerable Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java). The CVE-2026-47889 vulnerability is specific to the Jetty 12 Core adapter's getSameSite() method returning null. This version uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter extending ServletServerHttpResponse) which properly serializes the ...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:cdc96934-fae7-5fea-903c-375d9b7bd8ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:231221be-9faf-5513-a37f-55defd4cf6ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ], "bom-ref": "urn:uuid:731063d2-f986-559d-a5e4-9f71152475bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.23-tuxcare.1 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.23-tuxcare.1" } ] }