{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9226bdba-1389-598f-93d7-d87359b3c31e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3", "version": "5.3.13-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.3.13", "type": "library", "group": "org.springframework", "version": "5.3.13" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:a36de292-cfcc-5ef7-bdfc-bebdee60eb78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:4c731ccf-ee6a-59b2-8583-1c4f6b7d5f7c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6a0bc951-1698-5e76-af12-5926667823e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2013-6429", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:d5522bd2-f640-527f-9ae7-729087182e7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6429 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2013-6430", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:4a8a9835-e6e5-5afb-865a-2ee64bc42515", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2013-6430 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-0054", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:25aa53dd-7e11-5314-817a-1f7e1743f2ad", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2014-0054 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13 is not affected by CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter). The fix was applied in upstream commit edba32b309 on 2014-02-18 and released in Spring Framework 4.0.2. Version 5.3.13 (released 2021-11-11) inherits this fix from the upstream release. The vulnerable pattern (missing external entity protection) is not present: all XML message c...", "justification": "code_not_present" } }, { "id": "CVE-2014-0225", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:0ca40c4f-098a-5756-be48-96b30f4bfc61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-0225 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-1904", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:85f2e16a-7766-5c88-b806-0a54a359c212", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-1904 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c4efec44-ecfe-5f82-a031-74ed05f0eda2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2014-3625", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:2c75f172-76f3-53ec-8991-616bf9b4e3ae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3625 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:fef9e7c9-4e5b-5dae-9913-3b94357740fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2015-3192", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e189253e-9f27-563c-b7d0-fbe6a4d75352", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-3192 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:b2fce797-10e1-5f8b-829c-6c9f5b8b8474", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:61eb8414-66da-53a4-afd5-aa5ce5db09fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6844eeb8-5456-5249-bbfb-8a42773aa30d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2016-9878", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:71bab985-44de-5c76-8d8c-404402880f08", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-9878 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-11039", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:1d711bd1-3149-5c3e-a57f-a2bfac234335", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11039 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:ac29c6dc-4094-51ad-bc48-87b62ec6f6e8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:07b8b7a8-184a-5f7a-891b-3254f2be9432", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:9dfb466c-0b86-5de4-a58d-f92b2f938a44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1257 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:8698d593-93a2-5cae-8beb-010cd65b444e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:9cbe2a68-234c-554f-97eb-5147a8db90fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c5d97030-c547-5181-a194-0c6a83fac681", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e1c602a7-1cd2-5a30-a786-fc3e384a324b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:d83d2bf3-5154-5c48-850d-a74b2821835a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2020-5398", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:f6902dfc-e1c4-57d7-aa42-6c92ff29a2b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5398 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:17de1f61-f4a8-5631-8b15-8eb3db7ea019", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:00c04ef1-d5bc-51dc-989e-4042f1211add", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c510c23b-934d-5c23-a37a-cccb958c84ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6e31a86b-e737-5168-9b25-43f6b2e15606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e51cbf78-67cd-59b8-b9b5-ab4c1b62d7a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:f4a886b1-7f10-508c-a899-bb8a1ad646bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:10aadb91-1db3-5313-9879-6896775d512a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20860", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:2d72738b-f151-5b8d-a868-3d7ac5d07fdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:822c700e-c492-5d4c-b69e-e66c2282117a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:33154fb7-294b-58cb-b00e-3deb5e25e2a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c8e09e44-f501-5d28-9b48-ddaa86583530", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:473beec9-d830-5939-86d0-00fc77b87516", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:bc50fd7e-4f22-51ba-8eb3-14a27140de38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:ae19bf76-11b6-5703-896d-6dc71712ad55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6decca8a-9457-5c1a-84a4-7331f27988d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3efb6268-0e3b-59fd-b734-31194c589737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e81d4307-4c1a-51cd-a830-355d3b48d229", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:de355a20-f99f-58ee-b9d8-bd07086794ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3cfc5cec-67b0-5190-ae08-ad8be9fac878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:821c97a6-3cb4-53b7-8284-a39d6de7248b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Version 5.3.13 is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() bug in DataBinder's field matching, but version 5.3.13 does not contain the vulnerable code pattern. The CVE-2022-22968 fix (which introduced case-insensitive field matching using toLowerCase()) was never applied to this version, so the locale-dependency issue that CVE-2024-38820 fixes cannot e...", "justification": "code_not_present" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:95d39f80-5371-548e-81d8-54aec64cc866", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38828 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13 is NOT affected by CVE-2024-38828. The vulnerability was introduced by an optimization commit (gh-31834, 0970b1dc7a) on December 13, 2023, which post-dates version 5.3.13 (released November 11, 2021) by over 2 years. Version 5.3.13 properly allocates ContentCachingRequestWrapper's buffer using the contentCacheLimit parameter, never reading request.getContentLength() when...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c7eb3e2f-eef5-5c48-8fe5-5cf6ecf0cec0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:04a5d8a7-3e97-5e3b-a285-6710dddcce5d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13 is NOT affected by CVE-2025-41234. The vulnerability exists only in versions 6.0.9 and later, where a new dual-output feature was introduced for Content-Disposition headers. The vulnerable code path (using a PRINTABLE BitSet to encode the filename= parameter) does not exist in version 5.3.13. The target version uses a simpler, older implementation that safely encodes dou...", "justification": "code_not_reachable" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e8830669-33dd-5c4c-ba31-f5e71d0b4280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:99f23746-8863-5773-81bd-c67e6678de0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:346b5e97-1aeb-59d9-ab2c-43c64fd2a9b4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:6f6e7864-cb7f-5126-b18c-2d7966202e56", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:384916d9-ac6e-5282-81c8-7af8e8d23c78", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e2a14ee8-608a-5b32-9150-6b1c3f84619c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:eb304778-b27a-5386-ab63-31c2260454f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:d982b929-a27f-5cb7-b04a-a1cb1fe8bd19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:1bc76083-04e4-581f-8b05-f30707e4655d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:1fc01f64-dfc0-5137-8e1b-76d4e9b8eeff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:36d77a71-8f8b-5769-bc15-5d147c95c8fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:5702a9b8-97ad-5325-a0a5-4b41010e1426", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:d4a79a42-713b-5968-adb9-5b3c53bc3905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:dfa6ea14-259e-5e5c-a95a-d0ff9a09349a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3816dc45-0bf4-5242-8f4f-b1651ca5051c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc, and is fixed in 5.3.13-tuxcare.4." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:586e5ce6-4369-55f8-ad28-d6bea461209b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:84af4a92-4728-5aa5-8c85-90a4d87e90c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:8c35903b-9580-5cb3-bbe6-e08c98d823cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:b125b9f2-05cd-59ee-a621-f0f83e52a2c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47883", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:883a9feb-f2e5-5915-a241-03f66d89c6b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47883 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13-tuxcare.4 is not affected by CVE-2026-47883. The vulnerable component UrlHandlerFilter does not exist in this version - it was introduced later in Spring Framework 6.2.0-M2. The CVE describes an open redirect vulnerability in UrlHandlerFilter when configured with broad patterns and processing URIs with double leading slashes (e.g., //path/). Since UrlHandlerFilter was no...", "justification": "code_not_present" } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:ca604e44-e0e1-5826-b80e-2e1dc654e66f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:0dbe6b7c-2f84-54b7-a452-fa428d7a90f4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47885 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13 is NOT AFFECTED by CVE-2026-47885. The vulnerable class PartEventHttpMessageReader does not exist in this version. PartEventHttpMessageReader was introduced in Spring Framework 6.0.0-M4 (April 2022), approximately 5 months after the 5.3.13 release (November 2021). The maxPartSize configuration mechanism referenced in the CVE was added even later in version 6.1.0 (October...", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:24d34045-f660-5095-87f1-771cd6cce83c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:2af47c0d-31b1-58ad-8741-a56fb9b39dea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47889", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:fbcfcc37-fcf6-50f3-92c5-eade41270a07", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47889 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.3.13-tuxcare.4 is not affected by CVE-2026-47889. The vulnerability exists in JettyCoreServerHttpResponse, a class for Jetty 12 Core reactive adapter support that does not exist in this version. Spring 5.3.13 only supports Jetty 9/10 via servlet-based adapters (JettyHttpHandlerAdapter \u2192 ServletServerHttpResponse), which use a different cookie serialization mechanism (Response...", "justification": "code_not_present" } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:c8b43b6f-a54a-537e-ad48-41345f36a35e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc. Target version 5.3.13 is not affected by CVE-2026-47890. The vulnerability requires SSE (Server-Sent Events) Fragment streaming functionality, which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.13 predates this feature entirely - the vulnerable code path does not exist. The CVE affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8, all of which postdate the target version.", "justification": "code_not_present" } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:e5490f6c-bf77-5ff6-b032-83c44567ebd9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:7ae03d63-205c-59a7-8d0f-934adfca810b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:3c477b7a-55a9-525b-b115-546173e9cbf6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:319d5a1d-2bc7-5db4-8f10-f88a1b20fc63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ], "bom-ref": "urn:uuid:cfbd5bb3-23a9-581b-86c5-8ad733b3f50d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.13-tuxcare.3 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.3.13-tuxcare.3" } ] }