{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:83c78e99-5af7-5035-9898-ecc72fa07ad9", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2", "version": "5.3.6-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.3.6", "type": "library", "group": "org.springframework", "version": "5.3.6" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:8341513f-30ba-541c-ac5b-80538ad4d405", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:725645c3-d28d-5e53-86f8-e6599c2e8199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2efb7a18-ab46-52b3-bc08-964c2782f272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:99858e6b-c763-5345-9f90-beac8a52b493", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:fe730786-0732-5d36-82f9-a991afb1b018", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:af7492d4-301f-5e6d-903c-4fd6f1147a67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ee0bc8a6-8176-5874-beaf-8a02fc7fda0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:07a9d943-5e71-5b20-9d99-d682c62d65bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:68055bbd-7539-5d2b-98c6-7bf7a84ac1e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ef1f15f5-d5d0-5912-9a28-f29ab5782552", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:cd3fe78f-0ade-5ee6-ad1a-3a4c43fb66e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:ec731f2d-41cd-5f54-825d-a197791476c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:829121cf-46b5-5c9b-b785-dfe1edae7356", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:eed2ed4c-d29c-5066-85c0-5b1fba81dfc8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:871930e7-d5e8-5ec2-b23f-09abee4c2d8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2cf1d319-9b02-5731-85a7-7a99223d5239", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:327e6c02-7655-593b-8889-c5e42179b533", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:188cf70c-9f47-58c7-9e13-eb964f213498", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:61d5f691-c5ab-57a5-b4a2-427feba84c7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:3ee5cc00-1e64-5f82-8afe-64095f0b4605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:48e53466-f0b1-56d6-a136-d9879c6a197f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:42a7fde3-0e1a-5599-b382-b63b921997b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:380b505f-444a-59bf-adcc-f5a78ef87813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:7b76ddeb-c6f1-5856-bdb3-2dfbbdc4e2ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:788f2c2f-bae8-5c5d-9e5d-70e12c6cbcd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2cff0b54-fa84-5373-87b3-6b465e66152d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c12fee6b-6349-55ca-a5ad-735a7977848d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c904a471-5a71-5f58-bc9c-e08f14c711cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:9d141ea3-21c3-58c7-a7cc-c2a887d7e12b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:cc593878-93aa-51c7-a01c-c3947e473596", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2024-38820. The vulnerability concerns locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, which was introduced by the CVE-2022-22968 fix in version 5.3.7. Version 5.3.6 predates this fix and performs case-sensitive field name matching only, without any toLowerCase() calls in the affected code paths.", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:1088ee63-3439-51c0-8dc9-d1e3768ba922", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.6 is not affected by CVE-2025-41234. The vulnerability exists in the Q-encoded (quoted-printable) filename parameter that was introduced in version 6.0.5 (commit 58fbf60d2d, Feb 2023). Version 5.3.6 does not generate this vulnerable parameter. When using non-ASCII charset, 5.3.6 outputs only the RFC 5987 percent-encoded filename* parameter, which properly encodes double quo...", "justification": "code_not_present" } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:2d143678-5599-5eaa-908c-32b7608974a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:8153601a-01aa-549c-84d9-5396019aee43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:0e17dd77-cd37-568b-ab91-5707e09a235f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:9bae5971-a8ca-51f0-9995-067f89f34aa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:0d34867d-d49a-52cb-b811-af9a2f457d2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.6 is NOT affected by CVE-2026-47885. The vulnerable component `PartEventHttpMessageReader` and the `maxPartSize` configuration option were introduced in Spring Framework 6.0.0, not present in 5.3.x versions. The CVE describes a bug where `maxPartSize` limits are bypassed when `maxInMemorySize=-1`, but this vulnerability pattern cannot manifest in 5.3.6 since the affected cl...", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:da541acd-4cd5-5faf-8100-0cdba3bbcb91", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.6-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.3.6 is NOT affected by CVE-2026-47889. The vulnerability exists only in Spring Framework 6.2+ where JettyCoreServerHttpResponse (Jetty 12 Core reactive adapter) has a broken getSameSite() method returning null. Spring 5.3.6 uses servlet-based Jetty integration where cookies are serialized via ResponseCookie.toString(), which correctly includes the sameSite attribute. The vuln...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:c8f296f1-c05f-54cf-a2d7-9273ef7bf6cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:436abe84-7de5-5a6e-b982-883b3eb7a750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ], "bom-ref": "urn:uuid:f381bc7f-e686-5e59-bb70-b4aaf955f365", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.6-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.3.6-tuxcare.2" } ] }