{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cb868b13-8675-5201-beb4-3eecc2a5ab3c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11", "version": "6.0.23-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:751e7ba6-b9a3-5373-ac99-f8522e3cc9f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9259224e-5da6-5877-8212-268f32d0a72d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:92cb0bd2-7fc7-5308-b7bc-129245d38c9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d1735312-5411-5198-824e-776ad932c94e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:c6e9af0d-fa9c-5de4-ae50-dfff6af7ac3b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in spring-framework 6.0.23-tuxcare.12. The vulnerable pattern (unescaped angle brackets and Unicode line/paragraph separators in JavaScriptUtils.javaScriptEscape) does not exist because the fix was already included in the upstream release. The fix commit (f5c9fe69a4 by rstoyanchev@vmware.com) shipped in upstream Spring Framework before TuxCare onboarded version 6.0....", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ad4523e6-2721-53b5-bedc-fa74c74d6637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f733fca0-73b3-5e65-8960-bc0de46b6daa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:75492707-4bb5-5d30-9dd6-ea66e886eaff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ea4bd041-c33a-5fe7-9299-e2dcc956e750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:0757fa25-818c-5b9e-ac94-a7f04f8b1229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:e7ef9e24-f625-5b23-87c2-e65d6bbd2a68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:352beffb-d910-5f4d-afa3-23b0a2c19900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:53d4dfee-5c57-5e04-9e50-a5c78152af4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3ff15fef-6f32-5915-98dd-8c02ad657026", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6cb8586e-9874-541c-9eef-4574a6a8d1af", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9abb0be1-3c59-5d09-a534-b27084285caf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:31a0de7e-0cc0-5f12-92e5-9a339a2df221", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:b663c996-fa3b-5c9e-8066-a9ca1e6b908d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:92b84a8e-59ce-5e6a-b425-2416a30b9b15", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:dfeb8086-bb35-547e-a98e-5a1f11a40a2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ecf0d7ee-cbaf-561f-ae8f-bd1546113916", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:f82d6b1e-d12d-5d9a-bef4-ab2bcfcd2240", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ea70abe9-c014-5301-a496-abfe0b5b4af4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:1d8ae47c-5639-52d0-893a-df12078c79bc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:9c909b8c-4fa4-5fd9-a6b4-79c1560a86bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:27c04fce-1784-5d9e-8d63-3f3ffc688279", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:6549d146-58fd-570b-a6ac-ad9fb26a73ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ef9b1577-7873-566d-9127-da4f4bb059a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:673e305a-719f-586d-a28b-c3a0c284980f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:2cba0928-1bb8-5be0-af2c-a16c4a8ece48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:3228241a-0435-564a-9045-8d57bbee1136", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:ca8a2f51-99bd-5f2d-8c90-20e992a242ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:8a2b4ce4-d522-5d36-8ff9-78a23151f7c0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:42302a28-d6ca-5d42-b3b8-e6e25344d556", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:042c66cc-fe77-5af2-baf9-9300a58d6e7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:134fa075-a1d5-5cd8-b261-3dc4b13ddde1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:18a2c76a-995d-52fe-b21e-acda195fc7fd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.11 of org.springframework:spring-web. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:5df353fb-1970-5524-ba1c-2988f63c89f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d8adf785-d538-5bdc-be0e-82d2039632be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ], "bom-ref": "urn:uuid:d38969fb-0bfb-5fab-8e2f-6aaae5bcafe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.11 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.11" } ] }