{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ef4e310d-aa27-5ab2-9bd0-97a88b9ec949", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1", "version": "6.2.3-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e10c04a4-38c9-5a0b-ba9b-bcddbbf60d5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7908bb36-a007-5b8f-a399-e6f58b36d9b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:9bf6263e-657c-5547-aff0-2bd649b5e52c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:a2932eb4-f48b-52a1-968e-14101013c65d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:4cbd4717-20c5-5e4f-86fc-819d626a9f2e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.3 is NOT affected by CVE-2013-6430. The vulnerability was fixed in upstream Spring Framework 3.2.2 (February 2013) by adding proper escaping for angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029) in JavaScriptUtils.javaScriptEscape(). Version 6.2.3 was released years after the fix and includes it by default. The fix was authored by Rossen Stoyanche...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2f403050-6332-547b-bdd7-ad19ac07ad87", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:18f2260f-ca65-5cb4-99b7-d08d9449849f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:ee99ef3f-7cc4-591c-9508-ef56d284631f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations leading to memory exhaustion DoS. The target (Spring Framework 6.2.3-tuxcare.3) contains the upstream fix (commit d79ec68db4 by Rossen Stoyanchev, June 30 2015) that disables DTD processing by default via supportDtd=false and the disallow-doctype-decl SAX feat...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:97504b5e-9cd9-5d62-b5ba-aee84db93135", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1d9a7fdd-4cd1-5135-8a65-a37530e3800f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:098ebdda-43b4-50c0-9cf2-0b9246f7c186", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:718bcbd3-5584-5ddc-85a2-3a9102b4476c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:fb5eec32-c715-59db-87f6-bef84d89d8a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7f684835-2fdc-5739-87f2-ba94993f16d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:caa9e30f-8b7a-54d5-a5f4-1280c5e3d609", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d9a7430e-88d8-5e43-bcaa-6f981fbe72c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:10f9f0c1-2706-55d2-9764-2271a5df3766", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:acffdf0a-b846-50b7-ad8a-a46094198556", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:203e545f-6a74-5e97-bea9-249aee2066c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:732827e9-b587-5373-bfb5-ea87381acfe6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:1cb185b8-39e5-5637-80cb-862dc67fed01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2706451b-0651-59f8-af5e-eab2a95b78e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:32c52836-02bc-52bf-b27d-312bfabb6ac3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:0f3f9c62-28c7-520e-99d2-24d2ba249045", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b85ff6dd-c6e7-5f18-9459-afb8dee9fc35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e4ee5a8c-2a7d-5faa-9ccf-69d1e28a356d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:8ce90af6-38fd-5a2c-b119-02a8f6b7bbce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:e5eb0ebf-8f9a-59bd-8441-2a860dfa5e73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:60c34f5a-8298-5da0-9ade-8378fd1090ea", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:f1db3ea4-245b-508b-a249-d0e6a9b5da90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.1 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:687b1ea1-d133-51d0-9a46-7f677525100a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:76c55b47-3517-5bbc-9927-ceb6481ba935", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2d9b7892-f02a-5afa-b81e-a0c2b31a6dcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:431cb9df-14e9-5924-a25e-710453d61cc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:7c4252ce-0a11-5008-a8d9-23797eb5eb1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d3f3d641-f39a-5883-927e-43a781dd9849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:3cc8e7f1-ae8c-5590-a9bd-9dc1a64f279b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:d84421fc-7d6b-50e0-a0f2-ae601dcb3e62", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:b54854c3-212f-5ea5-9888-c885b66e3f69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ], "bom-ref": "urn:uuid:2466a51a-067f-5272-8891-b172e8aab6f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.1 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.1" } ] }