{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e53356f8-098d-52c4-b4d1-8c2caa152c09", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6", "version": "6.1.4-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:49d4f14c-82e5-5101-9dbe-779f1d73e542", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:185f3c0c-c9eb-5cda-9690-e2e3e4514471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3e3a2e37-d4cd-5cb4-9cba-6357221b4c9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5f806b49-3374-5269-b6bd-da96b79a2095", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:7ff1a5c4-c130-54d8-9e7e-3995b5f6b103", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework versions before 3.2.2 due to improper escaping of special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target version 6.1.4 is NOT AFFECTED because the upstream fix (commit f5c9fe69a4 from Feb 2013) is present in the code. Lines 79-92 of JavaScriptUtils.java properly escape all four vulnerable characters to their Unicode esc...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:bb9fc63a-cab0-5a0d-8786-9e2a47c56db0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:412f42e0-f7bf-5cf6-bf47-814658c2239e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:e9b19eb7-50a8-5c01-879b-24764c77c1c3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations, allowing memory exhaustion attacks. The target is Spring Framework 6.1.4-tuxcare.8, which already includes the upstream vendor fix from 2015. The fix (commit d79ec68db4) was authored by Pivotal developer Rossen Stoyanchev and shipped in the upstream release b...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ced150de-eec6-5358-913a-7c355c71ee11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:49399532-8c6f-59c5-9821-c3964d1c10fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:8671218b-7e63-5d6b-ab24-bfcf8be333d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d6958a6d-7f63-5b95-9146-2728c3d14883", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:03263f28-5915-5586-be58-765cdc9b6315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:795062b1-d932-5a4f-bb6e-d581e342160d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:817a0097-b803-5e3c-a1f6-ff7723a5ab9c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:1c3a738a-8ae3-53ce-b054-bdeca441fd45", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5698bc1a-2911-59c5-b153-bab06250d62a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:d702c861-2e1f-50d0-bd0b-a4fd1cc62103", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:57a71408-3b16-559c-8e3c-bb901c8bcc3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:21e90758-095c-5aef-b8be-2b4f1ba3cc66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:fd248a39-11be-598f-8efc-4bbe0f81657d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:c1565371-4bd7-5ca3-963b-94eb19f82697", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:5937ca6d-8230-5b09-a597-9b971d5d5619", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:99bd7e42-b8c6-5613-a5c5-52be90d36a53", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:8bf0a305-c254-5acb-a05f-2edc16ffa0d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:54c4ea83-59ae-5b86-bf49-773787fa659c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:beae136d-84fb-510d-92b5-6b10b5613f9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:169b0464-3ceb-52a0-a9dc-e7e18778d2e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:3496df6a-9488-5cac-8edd-2df5ba52b702", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:14eea011-e448-51af-bda5-5d12765ad34d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web, and is fixed in 6.1.4-tuxcare.7." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:299c59dc-4bcd-5c1a-be5b-577bb6cfa37a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:ef31ff90-3743-58db-b2e0-bf21c2ab69a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:dfce3690-3345-5df0-ad9b-a5ee13fa68cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:646ebd4d-9b49-50c8-b2ea-7f953950b753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.1.4-tuxcare.6 of org.springframework:spring-web, and is fixed in 6.1.4-tuxcare.8." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:589f0c5f-95f2-53f5-a999-3d037d044283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:70474071-5823-575b-af7a-5c287b68c31d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:96c5ddc6-69ab-57c8-8dc9-a4afa9b9cc2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.4-tuxcare.6 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2026-47889. The vulnerability specifically affects the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java), which was introduced in version 6.2.0-M5. Version 6.1.4 uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter with ServletServerHttpResponse) that properly handles the sameSite cookie attribute via servlet APIs.", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:a07ea4b2-ca39-532f-90b9-fe949efe0c98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:527d8a8f-21cf-54a2-b421-0d96c9bc8a3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ], "bom-ref": "urn:uuid:9e36921e-3457-5f44-b307-7dd3aa136117", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.4-tuxcare.6 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.6" } ] }