{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e7e53682-c2d8-5d93-8554-cd21dc39092e", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "4.2.9.RELEASE-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e4355c73-3645-5959-b403-a9f49d81b9c5", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b65c2a98-57bf-59db-8147-d15169bd8d1a", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8319bed5-20b6-58a7-b5b6-6aa6b87a706f", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:92b74240-43fb-51e5-9770-d5436d55cd55", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8060518f-4cc9-57be-badb-1d8e7dd002fa", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:8c324e0e-08ef-5ee9-87ac-c986b04c7112", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d8ba85d1-5111-5a14-aac9-64987ab835bc", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:78f25ff5-ff57-54f5-bfe1-a47c286bd78c", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:531db0c4-81e2-5ddb-9916-245bd214be79", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a757a27b-6782-5d96-b7bd-c579fa4c77c1", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:02a14013-adce-5db2-9088-5d5dc838e3d9", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a79fbee9-ed89-5d60-b76c-19ae2ad3c19a", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a98b7e2d-8a4a-50de-8c1a-ee2330dce3e4", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3990babd-3feb-5c33-8ed9-a5ee8c4860fa", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ad2fd393-7d88-5484-99a5-0bf0964e67b5", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:50550e17-441d-5af0-93f8-87134dcf00d2", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ea0c3a8c-b0db-51d5-a2fb-402a4cb86ad2", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:60b945bc-4313-554f-8cf9-ffc17633d567", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1a9461fe-9d86-5498-88f4-424e6f2e4311", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ab36d326-130f-5057-a80f-4b28982a327c", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7de137e6-2bbe-5a9e-a176-1d54968c3d6b", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f7a890a3-d7e5-5d4b-9e8c-8443557026bf", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fbbf92c2-ddad-5cc0-80ad-b41f6ac704f3", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:ff672b92-d40d-518a-a403-7af0482892b4", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:f4f9fc1a-79ab-5b39-ac33-8cf47ff98a67", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b659239d-3a82-5ea4-ba47-957774f65a65", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:10f3f708-1d25-56b0-8e5e-9fca9f945938", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3328bc5c-7a4f-56cb-a640-c4e768532799", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:089bac05-07a3-5e17-a8a1-a82487c9376a", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6cc33855-580e-56b8-8d44-747a14f5362b", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:7be3fab3-4a23-5f41-863b-49bad4e521aa", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d7f0524a-39b9-5c32-a1a8-e9c207251a26", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:dd3534ad-8db5-5c63-9914-28bd5cbf78f6", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c69bde10-5420-51fe-99bf-c32a910cc471", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:efc3a2a3-08a3-5bf7-b52d-42de6a58a16b", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9c998b4a-803d-5edf-850a-903cad413656", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:a111b0ad-7e78-5558-a67c-93d9365fa2d5", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cb6af9b2-c4a9-5d00-af96-5200ef14a601", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:44450175-4849-51e3-9c9d-d0716e60ee4a", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:47d4705e-e173-547a-9a85-b55edfa3f860", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:0c429a89-c108-57e7-9ecd-5771c0bc0c10", "id": "CVE-2026-41849", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:387bf07d-949a-5a1f-ad12-6e4787523b94", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4d1f38a7-aa80-5b4f-aa10-77e65ad1f429", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:6a009fcc-1ecc-592d-aced-a9f218293aaa", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:93281d93-47f1-57ff-95b4-7d3a6ffa548f", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:85545d7a-360a-5400-a0be-80e43517cc09", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.6 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.2.9.RELEASE-tuxcare.6" } ] }