{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f1d8b6ba-fc37-507e-971d-21c26cf916bb", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2", "version": "6.2.3-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:c1e7effd-aa13-5437-a7b0-228038f1b962", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:4c9715ef-d90e-5a65-a851-b73c423d760c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:02da9b5b-991f-5567-b8ef-c08a2feb0d8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0c085580-7e7c-5608-b16c-7955daedded7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:709e194d-c7f4-54f7-b991-27d0458724b5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2013-6430 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.3 is NOT affected by CVE-2013-6430. The vulnerability was fixed in upstream Spring Framework 3.2.2 (February 2013) by adding proper escaping for angle brackets (<, >) and Unicode line/paragraph separators (U+2028, U+2029) in JavaScriptUtils.javaScriptEscape(). Version 6.2.3 was released years after the fix and includes it by default. The fix was authored by Rossen Stoyanche...", "justification": "code_not_present" } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:06854ca6-83db-5753-a15f-9634a31c4862", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3a2cdd7f-82e8-5758-84f1-2c75fa8d46fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:981df247-0c35-5c3e-9f22-1f944b1ec873", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2015-3192 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2015-3192 affects Spring Framework versions before 3.2.14 and 4.x before 4.1.7 due to improper processing of inline DTD declarations leading to memory exhaustion DoS. The target (Spring Framework 6.2.3-tuxcare.3) contains the upstream fix (commit d79ec68db4 by Rossen Stoyanchev, June 30 2015) that disables DTD processing by default via supportDtd=false and the disallow-doctype-decl SAX feat...", "justification": "code_not_present" } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:84564d5c-362c-58de-8f74-459286b61645", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:518667b8-f63e-570b-9664-32368e151e7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:38af4a00-3d72-5e64-8e80-3d9c2162991a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:bacb6fab-b1f5-572d-a06d-8d3538f1056f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:897c6b9e-3f56-512d-9c0e-f25348f4c516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7a3a17f6-42f9-5cd5-99cd-3f0f109c63e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:942c96a1-e969-57b5-b43e-0c429df41f22", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2018-1257 does not affect Spring Framework 6.2.3. The vulnerability involved unchecked parsing of attacker-controlled Spring EL expressions from STOMP subscription selector headers, leading to potential DoS through regex/expression complexity. The upstream fix (commit ff2228fdaf, April 2018) added the ability to disable selector header support via setSelectorHeaderName(null). A subsequent h...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:96760233-d7b6-509d-805e-dff17baede3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:ede9c055-634b-5a20-87ec-50adff5b74cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:5cfc5784-b8bf-5e87-a155-24151a8a1e8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0bc375d5-b96d-548a-87d0-f481c7ad63f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:33512623-8ac2-50c8-9d35-d8605e225f19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9939de85-ccf0-56e1-bbe8-556e1806eaf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:610cbf41-a7db-5388-84f2-5896dad3cbe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:0be508f0-b823-5e7e-9d3e-eaaa33a7ee8b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22965 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. Spring Framework 6.2.3 already contains the fix for CVE-2022-22965: CachedIntrospectionResults exposes only the name properties of java.lang.Class and skips read-only ClassLoader and ProtectionDomain properties, so request parameters cannot reach class.module.classLoader (fixed upstream in 5.2.20 and 5.3.18).", "justification": "code_not_present" } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:69bf7afa-1394-54e4-a7a9-785f92b75f99", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22970 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2022-22970. The vulnerability was fixed in upstream versions 5.3.20+ and 5.2.22+ (released May 2022). Version 6.2.3 is significantly newer and includes the complete fix in the upstream release. The fix filters dangerous read-only properties (AutoCloseable, ClassLoader, ProtectionDomain) and specifically blocks URL.content from JavaBeans introspectio...", "justification": "code_not_present" } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:9d4179ce-78e1-5eb1-a151-1e6fe2148169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:524833f2-1270-58a2-baa9-1b9e0b28a919", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:10002682-1077-5163-aa66-532529e3913a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:7c723aa9-c449-58d0-9e9c-69e199719e4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8606ecaa-5507-5aa6-b6c6-f79e6cc26bdb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...", "justification": "code_not_present" } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:97edc3b3-3451-5c5b-9d80-e704958b3d90", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...", "justification": "code_not_present" } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:d9044e49-aabe-5b65-a7c4-4d086d17eee6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:60b31b5f-4a6e-52a5-ad16-c24a92aa9050", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:b3376430-f7c9-5b6f-810a-99325d4ca6bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:dcf1a686-bf55-583b-90a7-2ba676cd3bd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:25d97dbf-85ca-5d7f-ad9f-4c26f86679b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:f27744c9-dfb9-5aea-af1f-d7042b26507f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3520e430-1dd4-58cc-be67-edf0671a3937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:3c0e68d4-2d0a-5f6c-ab5e-3a2af16c0340", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:8daad93c-4c01-5549-862f-85a8d03f1fd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ], "bom-ref": "urn:uuid:99858318-b94d-581a-b254-243e1ae31d53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@6.2.3-tuxcare.2" } ] }