{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:c3bf8d6d-161e-5bce-b645-9326cb68f7a0",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-webmvc",
      "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2",
      "version": "6.2.3-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-webmvc",
            "purl": "pkg:maven/org.springframework/spring-webmvc@6.2.3",
            "type": "library",
            "group": "org.springframework",
            "version": "6.2.3"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:369cd91d-f1d4-5c28-b563-0e8e07053040",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:210cb937-5aa2-54d0-a875-ea66264999c5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:049cf9d9-0945-5c25-ba57-40d0aa5d9c45",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2013-6429",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d4a04c12-60c7-5027-bf08-7c7825169a74",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6429 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2013-6430",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cd9e0cc8-899f-5ccb-b99f-d58d3261b185",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2013-6430 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-0054",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:07ddbbb8-9653-5db5-b9ae-ed01d4b7431c",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2014-0054 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2014-0054 (XXE vulnerability in Jaxb2RootElementHttpMessageConverter) is NOT present in Spring Framework 6.2.3. The XXE protection was introduced in the upstream Spring Framework release 3.2.8/4.0.2 in February 2014 (commit edba32b309) by Rossen Stoyanchev, long before TuxCare onboarded version 6.2.3. The current code at spring-web/src/main/java/org/springframework/http/converter/xml/Jaxb2R...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2014-0225",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:82844b9e-397e-5be2-8e09-3d48c139557e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-0225 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-1904",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dd030800-d8b0-5fc5-9833-ba4645fcdd51",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-1904 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:60627aba-d394-538a-875c-b446052a34e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2014-3625",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e8ff2719-ffef-53a9-95e6-9f9d0fba9588",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3625 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3965cc2c-0909-5acf-bea4-daf8f964f70f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-3192",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c7bf3959-2f31-5e75-9fb4-c7f0a075743b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-3192 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:65e67398-b4fe-52a4-9800-05adaf134b1d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:134669fb-8573-5652-822b-6742e9e56f2a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee007070-c16b-5e31-8a2d-0c906e52b0cc",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2016-9878",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:641e912f-6a36-52e7-a5fd-eb904c28c02d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-9878 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-11039",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d08cf80a-5e1d-53d1-b95e-902378a5033e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11039 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ce617a76-5bdd-5496-b298-4381a973bc02",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:27790683-8539-5e74-aaa2-593333b2df5b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:02c0b3ce-e599-5f6e-95ee-40a44b9ef219",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1257 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6868f9c2-e39c-5e34-865b-88c02e7e2510",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b7f0e949-7dfa-5053-9b37-5266b5ca0cf3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:dfc395df-3972-5141-ac0a-c7fb2e25aa64",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c32b15ba-d52d-5e57-9e3b-b8d67fd3e75e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2020-5397",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6009544d-d460-515f-8165-d8bba3a82680",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5397 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2020-5398",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a1cfc0a4-ac69-5da3-8e31-07cb5ae8e153",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2020-5398 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cde66b35-678a-5e71-926f-e48b19db101f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:77d5c4b4-3df0-5765-9b0f-4598b1e76dda",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2021-22118",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fde46c71-cd34-53ca-a061-1989f07b2a14",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22118 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5472d846-6be3-5a7a-9f2a-fbfd4faffae7",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:45574770-4bf1-5dad-835b-90e38e952a3a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2d9e160d-4c9e-56e7-aae7-b74fac7f890a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22968 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d2274457-9e7e-58a9-947b-93974b973cab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5f2cf51e-1826-5cdd-84e6-48801849d405",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20860 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:26866620-1577-5c6c-b37d-213dbfd29a53",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:40e190c8-393e-5521-9805-ab2f2dfc05f2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2023-34053",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:03f19665-c4d5-5ea8-b4c6-031e736fdc76",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-34053 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fbb863db-0297-51e3-8632-c99db9fe68f4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:de5cdeb2-c4c7-5316-9e15-b4a4f2d3356f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22243 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:493c276d-0fb0-527a-a36c-0619c783879c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4d19965d-e392-5825-9039-07af6cf57a39",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0ea0121b-2f71-59f3-b307-ad244c3d5804",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:f2263508-ff41-5444-a233-dcd59e6fbc47",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38809 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 CVE-2024-38809 is NOT present in Spring Framework 6.2.3. The vulnerability (regex-based ETag parsing causing DoS via catastrophic backtracking) was fixed in the upstream release before TuxCare onboarded version 6.2.3. The fix commit bb17ad8314b81850a939fd265fb53b3361705e85 by rossen.stoyanchev@broadcom.com replaced the vulnerable regex pattern with an efficient O(n) state-machine parser. The ta...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38816",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b5f16459-5733-5a7e-baab-797e52e18b46",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38816 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38819",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:31602d44-e6ec-5b4e-9bb4-c5e5561e9cad",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38819 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5c0d8a92-50ae-5659-bea9-af35e46e5011",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 The target Spring Framework 6.2.3 is NOT affected by CVE-2024-38820. The vulnerability involves locale-dependent String.toLowerCase() in DataBinder's disallowedFields protection, which could allow attackers to bypass field access restrictions using locale-sensitive characters (e.g., Turkish 'I' \u2192 '\u0131'). The fix (using Locale.ROOT for consistent case conversion) was authored by the upstream Sprin...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38828",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5bcb6420-13a9-59d1-bf51-665c2e2e2034",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38828 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2758283e-f016-54c5-9de9-1906d18a1a5d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41234",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:07e0596d-d6e0-5d84-aa06-fcd64230835c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41234 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41242",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cac6ba9d-137c-54f0-8531-7a8706b4f208",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:db19a258-62ef-5560-bd9e-78b8a80ae974",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22735",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:effe43a0-9470-5ab2-9aa2-6e4691985c0d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22737",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:468493b5-1a50-51ec-8d38-eaf153952235",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22741",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:da2b2ffb-2b61-5167-ac4f-57ac9e2154fc",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-22745",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:a85b1c2f-5fbb-5568-b036-133c3fa16799",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41841",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:14baf2ea-e143-5167-b7dc-61697ded2ce7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:26eba33c-493f-59ed-9e07-027076ec92e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41842 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41843",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:5a4988ef-428c-5612-8bae-49a539c04bd4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41844",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1fee472d-31e6-52a8-bc8d-647402f98677",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:bd9d056a-4bb7-51a7-ae56-5ed8af57fc93",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41846",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:73c51232-ec10-525e-9d21-a296f88df6c0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7cbc29c9-534d-51ba-947a-ffa6cff54259",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:24ec7701-2261-5ad7-82c3-67091efc2dbe",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8d320340-a854-5bba-9718-d97725cffe57",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aeba2f50-2c1e-5f29-bc02-de4157488bf2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc, and is fixed in 6.2.3-tuxcare.3."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d1ff4a6f-50a3-5470-babf-354a21ce0c51",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41853",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7b147a71-49af-5228-ae27-2928e6c47395",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:83a447e0-96b7-5596-a5cc-aff426b6b71d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47883",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:fdcab5d1-2a39-573e-ae40-761cb3ae725c",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47883 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47884",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:9ed9f379-66b7-5d9a-a4bd-0d00e8fdb71d",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47885",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7e95b97b-3a7a-571c-88f4-4f2312c3761f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:08d9a69e-2146-5864-8154-8aacb421eb70",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47887",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:eafd8e28-3a49-5b39-9336-45980b9f89a7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47889",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c371a225-6a30-52a9-971f-da0e1bc949aa",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47889 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-47890",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ad5981ca-59d3-566b-ab87-a75caa9a90f7",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47890 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2d2569a8-1883-5b90-91b5-804c658942b0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:881c9d69-7cbb-593e-9639-2bca630b7bdb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:571d00dd-7ddc-5c78-8231-87b70d1e0413",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59313",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aea7a231-a6f3-53c3-8f09-c1d3cb122c55",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:789a6067-8374-5960-b6d3-7b37fe88d300",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.2.3-tuxcare.2 of org.springframework:spring-webmvc."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-webmvc@6.2.3-tuxcare.2"
    }
  ]
}