{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b2083e6a-ddf3-535a-a717-badbda64a78f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3962490e-8afb-56a0-bb79-e47555f3824b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e29c7641-8821-5600-913b-11a73dc67245", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:dfbc7542-e9cd-5986-9b4f-1e3885fb66f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e604de4d-fd2d-5d68-b1b5-7ca4cb9983e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:4024a557-0780-52ee-8e6a-ecbb9b11a2be", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is not present in Spring Framework 5.3.32. The vulnerability affected JavaScriptUtils.javaScriptEscape() which failed to properly escape four special characters (<, >, \\u2028, \\u2029), enabling XSS attacks. The upstream fix (commit f5c9fe69a4, dated 2013-02-15) was included in Spring Framework 5.3.0 and all subsequent 5.3.x releases. The target version 5.3.32 contains the complete...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:7067150f-a1d6-544b-ac31-12869f4c41de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:4a15c8ad-eaa9-5bf4-891c-421742d8fd17", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:ff22259c-01f1-588e-96d2-78ce728bd5e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 concerns DTD processing in Spring Framework XML parsers that could cause denial of service through memory exhaustion. The target (Spring Framework 5.3.32-tuxcare.3 at SHA 332413a647) is not affected because the upstream fix authored by Rossen Stoyanchev (rstoyanchev@pivotal.io) on 2015-06-30 was already present in the upstream 5.3.32 release that TuxCare onboarded. All affected co...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:d72a7ae3-5452-5b6e-9c19-ee20e18046e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:8a243ea8-40e1-5638-9437-8a94e29b6bad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:17dd8617-62ae-5bbc-a9e5-19adc5b400f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:81913d6b-bb55-5e28-90e5-c4e3bdddc4b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:cbfb8c65-12e4-5888-b5b0-a1438a348ec9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3c11200f-a2ee-5e72-8c69-a272ca6f57e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9d30e5dc-7981-5486-96f3-d5673546dcf3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:34fd1f1c-9363-5930-a58d-7ccd9ce2ec0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e70e5fc0-30ea-5ba7-a559-0b074c036ccb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:1fe4a1b8-50c0-5ed7-bcef-cf0ad5f65b31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:6c708349-e966-5b09-b665-ec243d5675cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:28b52e55-9e07-599f-a1aa-6cbf5e89b085", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5c4ea339-2ff3-5c5b-8cab-95cff4c4be49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5b730c5a-ca35-5788-92af-380d5ad98a88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c9d49e54-3ccf-5b2a-8eed-f7efbaea8f24", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. Spring Framework 5.3.32 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:636f50de-270d-509e-ac44-fb5d47b840f5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2022-22970 fix was already present in the upstream Spring Framework 5.3.32 release. The vulnerability affects applications handling file uploads with data binding to MultipartFile/Part fields, allowing DoS through repeated access to expensive read-only property getters. The fix (commit 83186b689f, May 2022) filters AutoCloseable, ClassLoader, and ProtectionDomain read-only properties during...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c3e2390c-1cd5-5eea-b5a6-becb63895cfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2e4d2d05-58e2-5417-9076-0bb0bbd7cc3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e1f1d8ff-641d-5967-b91b-b10863d84242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fab30aef-1bd8-5d70-a259-706f3b1a450c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a26f12d6-50e1-5bd6-8b17-7865c5def5e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fb4eac50-165f-5713-b6b9-ba0374fd54d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3cfc161c-c408-5c5c-9f78-14a6ed0fef95", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is NOT affected by CVE-2025-41234. The vulnerability exists in version 6.x where both filename= (quoted-printable) and filename*= (RFC 5987) parameters are output when using non-ASCII charset. Before the fix, the filename= parameter's quoted-printable encoding allowed literal double-quotes, enabling header manipulation. Version 5.3.32 uses a fundamentally different archi...", "justification": "protected_at_runtime" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e532ef29-d95b-59b6-8d2d-0205bc592a2d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e07d0c8a-ba89-524a-a31c-307baa8eaa14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:fd47348d-668b-52ba-b4a9-1b27f7051094", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:a9c2c6b3-242d-50ac-b343-621d816d7922", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:37dae09a-b43f-5776-943e-1a6c95ad09e4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 CVE-2026-47885 does not affect Spring Framework 5.3.32-tuxcare.3. The vulnerability is specific to PartEventHttpMessageReader, a class introduced in Spring Framework 6.0.0-M4 (February 2022) that does not exist in version 5.3.32. The CVE describes a bug where maxPartSize limits are not enforced when maxInMemorySize is set to -1, but version 5.3.32 uses different multipart readers (DefaultPartHt...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:b32a8de9-7f7b-5b66-9268-e6a141c22e77", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.32 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which does not exist in version 5.3.x. This version uses Jetty 9.4 with a servlet-based adapter (ServletServerHttpResponse) that correctly serializes the sameSite cookie attribute via ResponseCookie.toString(). The vulnerable code pa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:67acc1e4-a918-5cb6-a476-1f42d860a740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:415f04eb-fdd4-5cc7-9c54-4756f866ddd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:5ebefee7-0fce-54cc-bbb5-7c5e4f83151a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.32-tuxcare.3" } ] }