{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:890bb0b6-bd16-5664-8178-efb5b4c15172", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3", "version": "5.3.33-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.33", "type": "library", "group": "org.springframework", "version": "5.3.33" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:d99a142b-9d40-5ed7-b1d0-2c6fbb5066cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:8a539f79-d296-5e81-ac13-9631a7815998", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:5cbea69c-e984-5b79-a046-2bbf9d826ab4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:9dd557eb-f073-5f23-8904-5817e627fc61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:61b29c8d-4a08-5eb8-8012-da0b16f7ff2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:8b5137c4-8ba3-5758-b889-17ea8ee6aed1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:0d4b73c9-28b3-5d5c-b9a5-4c5fa6ce225b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:15ef654a-5f1a-5ea0-b5b8-bdc588e53041", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:a87b7e1a-afe4-52ab-a366-f31482c3bcc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:d1bdcd0d-6aa5-5dad-b1bc-1e054dd6ce33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:fba18c6a-4f43-5dbe-a997-f017254a89cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:bf18a5fd-909c-54c0-b26f-53a36faa1046", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:f209851d-8758-5f42-acfe-2d6e776e790d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:e872f5cf-b65f-5681-a0f6-9b27c1950ec3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:bebe45fd-0d75-545f-9007-6736d7e61c30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:5af2e18b-3ce3-5602-b000-f2317e0f3ef6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:72d8ec67-32ba-5512-9dec-9f795c621a90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:314fbb45-dd72-5114-8dec-a61d41d0370c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:5a4d417f-3dba-5844-8491-674bf719b4f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:3fdf42d1-b3f6-587e-8ae0-6cc152979bbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:42a36d1b-6d71-58af-a58b-24e26f6327a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:c5378f85-11e2-5184-9934-8c6a9e3e31ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:cf877e49-fd24-56e0-bff2-af4ee57971a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:4b6ed989-1ed8-5606-92cb-55db81e943c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:981b3573-6aec-50d1-b4bd-0aa3905e18d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:7081dceb-ed65-5b4b-b790-3bd59cdb2069", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:c9d18335-b98c-5b33-8dc5-c451e1692fad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:548aee4c-aecf-547e-a230-007be7f83f7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:a6a63873-1f43-52e9-b12e-ff545fb3a3b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web, and is fixed in 5.3.33-tuxcare.4." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:3ee01814-accf-5ea6-82f3-95fb9ef72e2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:2da6af98-2ab7-58d6-a8c1-dbd512ff264e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2025-41234. The vulnerability exists in the quoted-printable encoding feature, which encodes non-ASCII filenames using RFC 2047 format (=?charset?Q?...). This feature was added in Spring 6.0 (commit 58fbf60d2d, Feb 1 2023) and does not exist in 5.3.33. The target version uses only RFC 5987 percent-encoding for non-ASCII charsets, which properly enc...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:b712f458-8c7d-5b51-a635-e24c44d3c407", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:3a5250ed-1152-5f4c-96db-b520197ebf5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:1a9379b1-da0b-547c-acea-1a95de932085", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:c8084cbc-a7f7-5199-bcf3-b3d992412232", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:a58d1ddd-834a-5e57-8061-58364bf86dac", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2026-47885. The vulnerable component, PartEventHttpMessageReader, was introduced in Spring Framework 6.x and does not exist in version 5.3.33. The CVE describes a vulnerability where PartEventHttpMessageReader fails to enforce maxPartSize limits when maxInMemorySize is set to -1. This class and its associated PartEvent API are absent from the 5.3.x...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:69184f6d-078d-5c04-9c11-e37a1d17976d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.33-tuxcare.3 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.33-tuxcare.4 is not affected by CVE-2026-47889. The vulnerability is specific to the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse class), which was introduced in Spring Framework 6.2.0-SNAPSHOT on 2024-01-15. This class does not exist in version 5.3.33. The target uses the servlet-based Jetty adapter (JettyHttpHandlerAdapter) which correctly serializes the sa...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:d3f583a6-442a-5b0e-a66a-9218f5d73182", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:f93c0be7-d0db-5e11-955f-37400ee90b33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ], "bom-ref": "urn:uuid:c16caf02-4beb-5c8a-8ed5-9040bde00d60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.33-tuxcare.3 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.33-tuxcare.3" } ] }