{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:25fdaf10-590f-5db1-869a-34daa813fad2", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8", "version": "6.1.4-tuxcare.8", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.1.4", "type": "library", "group": "org.springframework", "version": "6.1.4" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:80ca58fb-162d-5ac2-8f3c-bc66c44c5441", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2009-1190. The vulnerability required Java object deserialization from untrusted remote sources to trigger catastrophic backtracking in JDK <1.6's Pattern.compile. Spring Framework 6.1.4 does not expose Java object deserialization via HTTP endpoints (uses JSON/XML/Protobuf instead), has no RMI or remoting features (removed in Spring 5.3+), and only ...", "justification": "code_not_reachable" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:34707897-7a0d-5f77-b97e-a358cc4ff20c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:8453c9e2-549b-5265-b76b-8fae3bc05c04", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f7f65b2e-f7a6-504e-86c5-1e3f8a8a0190", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6429 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2013-6429. The XXE vulnerability in SourceHttpMessageConverter was fixed in the upstream release by commit 2ae6a6a3 (Nov 2013) authored by rstoyanchev@gopivotal.com. The fix disables external entity processing by default via the processExternalEntities flag (defaults to false) and sets appropriate XML parser security features. This fix was already p...", "justification": "code_not_present" } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:38eb7e8b-e512-50ee-af48-b441ce389192", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2013-6430 affects Spring Framework versions before 3.2.2 due to improper escaping of special characters (<, >, \\u2028, \\u2029) in JavaScriptUtils.javaScriptEscape(). The target version 6.1.4 is NOT AFFECTED because the upstream fix (commit f5c9fe69a4 from Feb 2013) is present in the code. Lines 79-92 of JavaScriptUtils.java properly escape all four vulnerable characters to their Unicode esc...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:83cf19ea-caf7-513e-92b1-e8bf2d77c4e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:bd840485-2f32-5ea2-920c-c512098b11ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:b6ea099d-1a5f-5ba1-8250-57e7babefa01", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations, allowing memory exhaustion attacks. The target is Spring Framework 6.1.4-tuxcare.8, which already includes the upstream vendor fix from 2015. The fix (commit d79ec68db4) was authored by Pivotal developer Rossen Stoyanchev and shipped in the upstream release b...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:7a86754d-3b56-59a1-a0f4-add78a8b49c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:531eb8a1-90cf-5bab-a2c0-fe939d4b1520", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:aa202414-7614-5117-88d3-eecf08cbd1b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:d5b79de0-f540-5818-874a-efbf97318b90", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:79660120-1208-5c72-8a4a-f092a506bc8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4d645c77-cfb2-5482-95eb-e5d5f42f02d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:284b6fab-48f5-5398-a5ca-32e15bb3e415", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2018-1257. The vulnerability (DoS via malicious STOMP selector header causing regex/expression parsing exhaustion) was fixed in upstream Spring Framework 4.3.17 and 5.0.6 (April 2018). The fix - a null-check that skips selector expression parsing when the feature is disabled - is present in version 6.1.4. Additionally, as of Spring Framework 6.1, th...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:965684f7-6fc0-5c32-a9ef-eabf2485b66a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:97a9993f-b1bb-545e-9ad8-3d31ff9a5919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:4f372d44-e501-562b-8729-263234047072", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:273f36be-9be6-5f33-a79a-331a82537696", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:ce0af621-deb5-5fff-aa86-402ef004d2c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:72388e7b-2107-5c43-a3c3-aa86ed15fa68", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:aea47022-fa8c-5d8f-9cc3-121e1efa5e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:3dca5766-26f1-5960-a54a-071ede37a678", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. Spring Framework 6.1.4 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9855e618-7171-58e0-bdf6-1fc037acaf6c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2022-22970. The fix was already present in the upstream Spring Framework 6.1.4 release that TuxCare onboarded. The vulnerability (DoS via data binding to dangerous read-only properties like AutoCloseable types and URL.content) was addressed in upstream commit 83186b689f11f5e6efe7ccc08fdeb92f66fcd583 by Juergen Hoeller on May 11, 2022, well before ve...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:77f16025-6355-5edf-984e-afa15b8ddbc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:9971eb85-f9c1-52a6-857a-a0741867ebca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:f0f08fec-c4d5-5820-a95f-2c83bf3235e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a12b8385-83e6-554b-84e7-0c559ee6a8d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:5ef3e618-b61a-5834-85ec-5fb262693c37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:5c60090f-f384-59ca-9f24-5f027913db28", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:a17df3f1-21a4-52df-bac1-5cedb624edcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:e4f25aa8-420f-5c71-8e8f-a08cc8f727f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:08eaf5cf-f21f-51f8-b25f-1c6524460f18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:d23b97d3-dd11-59ed-b283-cae256cf7260", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:3efff242-2951-53d5-b36c-659a6d02065d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:475e8608-f01f-5516-9cb8-2269bb26c160", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:84a9ea26-6006-553f-9159-cb900679741b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 6.1.4-tuxcare.8 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.1.4 is not affected by CVE-2026-47889. The vulnerability specifically affects the Jetty 12 Core reactive adapter (JettyCoreServerHttpResponse.java), which was introduced in version 6.2.0-M5. Version 6.1.4 uses a servlet-based Jetty adapter (JettyHttpHandlerAdapter with ServletServerHttpResponse) that properly handles the sameSite cookie attribute via servlet APIs.", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:aad57033-29a3-5cce-b519-02010e6741b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:94a9d6c8-26b8-51df-ae12-2f7986a8c02a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ], "bom-ref": "urn:uuid:d85039d5-d9a6-5217-8761-703439e371c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.4-tuxcare.8 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.1.4-tuxcare.8" } ] }