{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:32ba46ce-f75c-5b58-9b0e-5e4e0e98d7ce", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1", "version": "5.3.32-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:dd2cc3a2-a6ff-5cf6-93ca-783d51a8c9fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:94baadea-2661-5174-b956-c2dd822215b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:18aefe96-c421-5a89-864f-40981af3232c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a02513ad-4ae8-55de-ac84-3fe56017685d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:ad0cea3d-dc65-57ff-86cb-9bb0a765610c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 5.3.32. The vulnerability affected JavaScriptUtils.javaScriptEscape() which failed to properly escape four special characters (<, >, \\u2028, \\u2029), enabling XSS attacks. The upstream fix (commit f5c9fe69a4, dated 2013-02-15) was included in Spring Framework 5.3.0 and all subsequent 5.3.x releases. The target version 5.3.32 contains the complete...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:fd65bbee-7d3f-5e78-9ac8-761f6417eacc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:642a5d39-09e3-594f-9b4e-ade6c75cf5a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b7dc646f-8dc4-5a44-a066-4b7b3eedea85", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 concerns DTD processing in Spring Framework XML parsers that could cause denial of service through memory exhaustion. The target (Spring Framework 5.3.32-tuxcare.3 at SHA 332413a647) is not affected because the upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2015-06-30 was already present in the upstream 5.3.32 release that TuxCare onboarded. All affected co...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:df817c4c-d987-5339-86d8-33d24d760318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:700f0373-bd7d-5240-af38-87fc72458008", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:06664008-bae9-5772-8e90-93216011bf6a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5879b1bc-292a-5ead-9517-707c7f3a1666", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:461eb239-b62d-5e83-b4d4-b2046a3c3583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:92a134a9-1f88-541e-9489-493975cd9fa4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b99c5d26-7d99-52fd-82e6-e57a5b49b035", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b558693c-c72e-5a59-a1d5-6ab0706edd9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:814ca0b1-59de-54e6-8b09-dcf16c0b1174", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:800f9519-d6c6-5118-8731-d4577c3b1da3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:db2a5e44-1ed3-526d-ab00-3fdafc67abb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:bdbed6c2-45ad-5541-a63d-709d38e6efb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:8385f1e3-9578-506a-93f9-94f63c860f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e3d0be99-1fc9-5c7a-853b-5ee19db8f997", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d5f49301-883b-5cbe-a8c3-2d5b6d55e4d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:734685f3-02b1-54c5-87d5-95c1d27aebb4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:57bfa3ea-b2d3-5869-ae69-dbde6e37eb9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a92fee83-fc33-5495-a22e-83876e6aa9af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:2449868c-3263-5060-b4f1-385698e40129", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:2454c8ed-4583-5f95-abf2-571492b4f39e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:ddbbb930-0808-5732-af1c-a27c98469735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:402e89e3-af12-5cd5-8abe-0ed35ee50179", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:733a1271-138c-5612-9822-2690ac408822", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2025-41234. The vulnerability exists in version 6.x where both filename= (quoted-printable) and filename*= (RFC 5987) parameters are output when using non-ASCII charset. Before the fix, the filename= parameter's quoted-printable encoding allowed literal double-quotes, enabling header manipulation. Version 5.3.32 uses a fundamentally different archi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:8c303c6f-cbb5-570a-83e6-a222f270a516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:93ac708b-1864-5c8d-b2f4-c991d5981872", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:49870e62-d272-544a-931c-4e6a5763453a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:c1587f0d-d5ed-55cd-958b-0c165a1436ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5f9534ac-5d71-5524-82e7-cb6be2d81e11", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2026-47885 does not affect Spring Framework 5.3.32-tuxcare.3. The vulnerability is specific to PartEventHttpMessageReader, a class introduced in Spring Framework 6.0.0-M4 (February 2022) that does not exist in version 5.3.32. The CVE describes a bug where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.32 uses different multipart readers (DefaultPartHt...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e61f34c4-43f1-56eb-b588-9984eb1823d5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in version 5.3.x. This version uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes the sameSite cookie attribute via ResponseCookie.toString(). The vulnerable code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:ef7e9866-b092-56c7-a3f0-46d3454bc99d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:e3e53ed2-f802-5c61-a9e5-6a13b01ae8de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:36675cde-8a25-5729-88bc-251f2556142a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.1" } ] }