{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cc05720e-da42-50ef-a99b-6ad1e7b89e64", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ea2dec42-0a38-54e2-b135-c0256e42f246", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:75286c7f-705d-5ccc-8960-3a2422ee64a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:94a61f7c-7b48-5d34-9c61-d61b45df4476", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8aabf1e8-c815-52ae-8979-77a52a40db53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:adcc2f12-07f6-564b-bcdb-81242bc16d71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 is NOT present in spring-framework 6.0.23-tuxcare.12. The vulnerable pattern (unescaped angle brackets and Unicode line/paragraph separators in JavaScriptUtils.javaScriptEscape) does not exist because the fix was already included in the upstream release. The fix commit (f5c9fe69a4 by rstoyanchev@vmware.com) shipped in upstream Spring Framework before TuxCare onboarded version 6.0....", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2b710a52-0a7d-56e2-b51d-966b74b66324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6dbcacee-f57e-58ae-ba76-0bf4225d1f80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8d8c55b7-c633-53ad-89f5-cb471eb1931b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2015-3192. The upstream fix disabling DTD processing by default was committed in June 2015 (d79ec68db4 by rstoyanchev@pivotal.io) and was already present in the official v6.0.23 release that TuxCare onboarded. All XML parsing components (Jaxb2Marshaller, AbstractMarshaller, SourceHttpMessageConverter, Jackson2ObjectMapperBuilder) have `supportDtd=f...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1b183035-6a55-5efe-9b19-d9a88c16d7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aa1d8e6b-93dc-5f12-adba-c7a24c9aa57e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6ccf3cb6-c322-5573-b837-dbfbafeb5820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0653798e-cf92-56a0-8a64-3c66222c8302", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:be46355a-645b-5f93-81d6-f7404e0ab454", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7908c560-7a91-5d81-9c47-090cb546bb3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d00c3265-2e20-554a-af3e-49fb7bcaeec5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions with unconditional STOMP selector header parsing vulnerable to ReDoS. The target (6.0.23) contains the upstream fix from commit ff2228fdaf by rstoyanchev@pivotal.io that adds the ability to disable selector parsing via setSelectorHeaderName(null) and guards parsing with a null check. This fix was already present in the upstream Spring Framework 6....", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:136ae0e8-c4b4-52b1-8b90-b7082beda689", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1c3661a2-420a-51e3-bd11-6949ce1809fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aff0f481-f1e9-523a-99f5-8e9cc5bf2e2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1461edbd-f810-5fcb-8c4a-8ba105718efc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:8e7504fb-a65a-5e89-ba75-931e78327bf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f088af2e-1eab-5114-a213-4f79efcc5f26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e0e12b8e-ad81-5d69-8460-ce5920c62bb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:2e2ed9ec-3044-5e96-a91c-8a9c00800c61", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. Spring Framework 6.0.23 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b453265b-1de4-55fa-b1bf-58a7c2a9f786", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2022-22970 is NOT present in Spring Framework 6.0.23. The vulnerability allowed DoS through resource exhaustion when data binding MultipartFile/Part objects, caused by introspection of read-only properties with dangerous types (AutoCloseable, ClassLoader). The upstream fix was already included in the 6.0.23 release, introduced by Juergen Hoeller in commit 83186b689f11f5e6efe7ccc08fdeb92f66f...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e633e78b-ad78-583a-998e-b7c79113c097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:97d5c538-64db-52e7-9510-32eff7b0e6e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ddc0a368-b2ef-57c7-8d59-520a63b8fd1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:19cd4b3a-263f-5a12-9538-bbfdb4308d50", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:083d3658-6b7a-566c-9d13-734f2895f5c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 affects Spring Framework 6.0.0-6.0.22 with a ReDoS vulnerability in ETag header parsing. The target version 6.0.23 is the upstream FIXED version. The fix (commit 8d16a50907c1 by rossen.stoyanchev@broadcom.com) was shipped in the upstream 6.0.23 release that TuxCare onboarded, NOT added by TuxCare backport. The vulnerable regex pattern (ETAG_HEADER_VALUE_PATTERN) has been replaced...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1da73d7d-7cef-515d-b317-1c6ca7644f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0f7ddbe9-5f27-5848-8b5b-3549356fabad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:10b4e4d7-f146-595f-9eac-2ed0696863bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:21c3dc55-47cb-537e-9e1c-da76754f9610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:67a6dc9f-e800-59fa-b9d4-181f2fdcd502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:1555cd15-bf26-5780-8b74-1570543b5661", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:abc3691b-8f0e-5e6b-b692-c8501f3fefe2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.0.23 is not affected by CVE-2026-47885. The vulnerability describes a bug in the maxPartSize feature where maxPartSize limits are not enforced when maxInMemorySize is set to -1. However, Spring 6.0.23 does not have the maxPartSize feature at all - it was introduced later in the 6.1.x release line (commit 66aac7e359, Oct 2023). Since the vulnerable feature is not present in 6....", "justification": "code_not_present" } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:804b387a-2ba6-5bd2-9e02-6188d7ca46f1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-web. not_affected \u2014 Version 6.0.23 is NOT affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse.java, which is part of the Jetty 12 Core reactive adapter introduced in Spring Framework 6.2.0. Version 6.0.23 predates this feature and only contains servlet-based Jetty adapters (Jetty11ServerHttpResponse and Jetty12ServerHttpResponse), which correctly serialize the sameSite cookie attrib...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:11001aa8-762b-5c09-a345-32c54c839b10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f9177499-518c-57dd-9f72-7569296c9986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:fe11c8a5-8744-514f-b79f-0b656dfc070a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.0.23-tuxcare.12" } ] }