{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d998da8d-7394-51ed-8da7-87d760bfdad4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7", "version": "6.1.16-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.16", "type": "library", "group": "org.springframework", "version": "6.1.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:62b24683-8bc6-53ec-9504-767c045a927e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:55e2a515-0991-5d2f-acd1-dd32a3e632ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:4b12716c-5574-53f8-aa6b-4ee2558de313", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:a7f90614-4cf3-5a87-8d6f-8313234d8bac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:b3368af5-d038-57d6-b35b-0ac5ad292333", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:84bb05d7-1c20-5b52-ae5c-ee2b81e414da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:40986e5d-2ad5-5c70-bf48-5101485ef0c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:19a0806c-f163-5fd2-ad74-a69df528b6f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:180f68a2-f8e0-5c14-a4d5-0baa6fcd114a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:03836966-42b5-5857-b823-11dedf35bf94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:a8144019-012c-5f88-a43d-ba557362da6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:b9ba071f-3e8e-5d3e-8391-4fb434425e5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:b7454329-fc8a-5235-9d12-f6bea012ed8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:464b2a30-d64c-5800-9eb6-aeb1f45f03e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:a04d3f8e-c638-5f24-abb4-eccbd0e8a1cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:53eec9b1-b706-5b6a-a4e4-3e93fdfbec8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:50864a3d-2ef8-536e-b186-60fec39d0663", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:19a359e9-38cc-50e9-ab71-bb4919888434", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:5a03f7ed-8acf-5479-bf0c-e04659257e1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:4ff7ca34-22bb-5a09-b536-e76cf2a05d99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:e8871afe-a2c1-535b-88cd-160b8af02b9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:61749dae-2428-5d83-92e2-78785594c242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:313a8800-786b-508f-8ae1-b78863f3004c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:a6a0c104-dd3b-5bcc-a193-5be898aa143e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:cb3341d1-456b-58af-b543-7e318f8bd70f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:5c260241-be4a-5219-aca3-ffc3110bf1da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:55d5f93a-5586-5067-ab2d-45d0e69d002c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:8d0de350-97e3-586a-9843-7f6e2d9320a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:d96fec2c-f9a9-5552-88eb-8803fdc8639b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 does not affect Spring Framework 6.1.16-tuxcare.7. The vulnerability (ReDoS in ETag header parsing via catastrophic regex backtracking) was fixed by upstream Spring Framework in version 6.1.12 (commit bb17ad8314 by rossen.stoyanchev@broadcom.com on 2024-08-14). The fix replaced the vulnerable regex pattern with an efficient O(n) state-machine parser in a new ETag.java class. TuxC...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:571d7b49-acb9-5c38-a2c4-783f80942fc9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38820 is not present in Spring Framework 6.1.16. The upstream release already shipped with the fix (commit 23656aebc6, using Locale.ROOT for case conversion). A subsequent TuxCare backport (CVE-2025-22233) replaced this with simpleMatchIgnoreCase(), which is also locale-independent. The vulnerable pattern (toLowerCase() without Locale.ROOT) does not exist in the current code.", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:07a6b8fc-426d-57dd-97ca-1cc65257ccdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:8e215581-8cd5-54f4-91c9-49c425fe722e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:37a61fe3-88e5-5b11-9be1-ede2f04a3440", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:b7824b9f-7832-53a9-ad24-6a931993732d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:60c3b0d8-4acc-5dea-a5cd-0e26974ba17e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:e2642bff-44c9-54f7-adfc-962ba6e33034", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:db3acfaa-f503-56a1-ae95-057acc096471", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.16-tuxcare.7 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.16 is not affected by CVE-2026-47889. The vulnerability exists only in the JettyCoreServerHttpResponse class, which is part of the Jetty 12 Core (non-servlet) reactive adapter. This adapter was introduced in Spring Framework 6.2.x and does not exist in the 6.1.x branch. The target version 6.1.16 only has the servlet-based Jetty adapter (Jetty12ServerHttpResponse extending S...", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:aef8d7c9-34ed-5246-a85a-9faca6e3f0fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:27a22d90-a3c3-57c6-aba3-8f624111c5d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ], "bom-ref": "urn:uuid:31387734-8e16-5aa7-82f4-2d4baf64d598", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.16-tuxcare.7 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.16-tuxcare.7" } ] }