{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9534a505-8967-59a9-a107-0d04627ffd3f", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10", "version": "6.0.23-tuxcare.10", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e7f32fbc-e65b-5717-8f2e-798921451561", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:2bd8a3b3-0497-5215-9ef2-efdb95da4a60", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:cd091f58-865b-59df-83fa-e6d9c881bab7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:05a7d760-56d9-528e-8c4f-55170ba4e7ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4d14f391-cf53-5718-b39a-e3d1655c2cc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:2c6a4bd6-2da6-58a3-918d-78b13c52e54e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:fe3c3739-2d9a-5b69-ba20-19ca2745f64d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1d86d45c-7570-5b09-9b97-8898b24da9a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a1924a4f-d30a-5f66-8442-97aaf4f8bbe2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3505562b-864f-55d5-ab37-2dc8c82fa37e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:48d1fb90-25f7-56df-8bca-120df1da0ee3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:bc50873f-c934-52ea-8c73-be42e8bbc01f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8d1dac7b-fa04-5bbe-aed4-d1b0d9adfeb2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:7e87a563-206c-5ab7-8d9f-e374ecc5641e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:91d7dc8c-2a39-5925-a6f0-4bbe4d96f432", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:ef210afd-171e-540a-9d94-21e98ea98b5c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8b2c224b-292b-5be6-ae14-a87d72893586", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:827170eb-d2a7-52f2-ab28-d1db66d3809f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:0ea887e1-37d7-58e3-b583-9fed3856de09", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:71c4183d-8610-58a5-ac0a-e9cf25ad5cfc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:3bafa95b-13f6-5f81-a4a0-a6aec4f95280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:1051a998-12c4-57c1-9257-a00f2ff12669", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:77905f15-48e9-5269-a0c8-7d6e2eb7ec3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:b42b86f6-5c1f-5350-aabb-e4b3429f6c96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c22c048b-0e52-5a1d-b174-0c90d6f787df", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:167f4e01-c3b9-5a01-b5d1-532097201fab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:83f0d616-19eb-5d8a-8e05-f655ba521bb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:a1a8d713-2bf0-5e8e-979e-833c100a6386", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:173c2e2e-e011-5e9f-9f6a-67be75c5496d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:d9844901-fc7f-54e7-932a-8d6ffde95162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4893e3a8-76d5-5a61-bb72-d0eb7aa819b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:c4d80f29-1c0d-53c8-9384-9711ee1feb81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:640bfa39-9c0f-5fbe-98f9-57b8de43ce2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:4350ae4b-41c8-52a4-9990-7cb2e85a3d15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.23-tuxcare.10 of org.springframework:spring-web, and is fixed in 6.0.23-tuxcare.11." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:711d43f0-cc5e-574b-b352-942f9a1a7326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5033b386-342c-53cb-b6d6-dec3c286217c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:9f7f77d1-6384-58a6-bafb-e32bf3fba487", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.10 of org.springframework:spring-web. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:8d805d40-f7c9-5a56-84ce-cb128b612ddf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:5d0cc1f4-dd2a-5a4f-a5dd-7e6a08d48656", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ], "bom-ref": "urn:uuid:e14a6fcf-9425-5e01-b79e-ac7e1965740c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.10 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.10" } ] }