{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e6959169-72c4-5c95-beaa-9d814d28c1a4", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-webmvc", "version": "4.3.30.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:769b554e-2560-5f5d-ab46-debfaa626a3e", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:dfa3627f-9f07-511b-950b-c1f80af35c80", "id": "CVE-2020-5397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f51ae66a-1af4-5603-b68f-f4a46c8646fd", "id": "CVE-2020-5421", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:77299c6b-9f61-5790-b959-14d69b5865dc", "id": "CVE-2021-22060", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:31a92b62-3e5a-514f-a577-3dc4f5bbbc08", "id": "CVE-2021-22096", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:62205a42-4c7c-5393-b020-cbc7714c4b11", "id": "CVE-2021-22118", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b777554d-33aa-5421-944f-1c188a0577ac", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5d68fad9-54b8-5eb8-9260-164f84ca78e0", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c975d04-b397-50e5-acbe-646bd9018517", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:12503cf4-cb1e-5fb2-bbfc-004e7c566b1a", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a6b19775-254a-5995-94b8-2861b188fa6c", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8d4a5713-763f-5726-acfa-fab1f3caa69d", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d83cac96-7de7-5807-94bc-627cd0fd6bf5", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a9c87d8d-17bb-55fb-9fe8-6066ceab35af", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e8696c25-3814-561d-9471-b52f8c08c94c", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:34e4ad30-167c-5281-9289-8a05fd16aafe", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c78cdd5-4841-5584-ae00-b319c7726185", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fb829b39-8034-5841-9d7f-76cdc5f12601", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fe065267-9afe-53a8-9858-b0270f01f91a", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:edb1b95d-6603-5734-96c0-0ea23e69f87c", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9fdd52fa-c69c-50da-8e63-af2f20f36056", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:37824f29-efc8-5087-a32e-456b5f00dd07", "id": "CVE-2025-41242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41242 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8b68b0bd-a4d9-5dbd-9c29-3da0afcb036f", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:db778033-551b-5f5f-bc1a-b16244aa56c3", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5a9d2d65-1f64-5100-96bd-1177757a9583", "id": "CVE-2026-22740", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:16378b33-651e-5ce5-b396-9d9bd9847d80", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:da3ee146-f7f0-5742-82ec-3f5e66a3c087", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9c96afde-565a-5073-a2da-815a13e438e5", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2d75a263-7e5e-594c-8abd-291245cf0897", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e05e53c6-e006-50d1-81b9-75ee944ac2bb", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8c6859b4-c2dc-5633-b9a8-9228e0aba2cb", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:41cde9e5-e6ff-5648-a0a9-37256abc2bbd", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bb1d4490-a35f-58f1-ae63-4e424d152789", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:15da1ff8-d566-5cb7-a57c-fd90134a26dc", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:10f35bfa-7e05-5608-9cf3-5a16f4aaa709", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:81b8fd3a-08f0-5c4f-b857-66f15ca280ee", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:47b34314-06e6-52ae-a7c3-269cf9eaabf8", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b2cbd85e-0779-5a5b-840f-a43a3094e2a5", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:415c9d98-ae67-5593-be7f-b295717387bd", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:87f35689-5d87-56d4-936c-ba9599ff58f1", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:feeb65d4-68ba-58bc-9f18-837ae6af7715", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a3d27e81-6a3d-51fb-9cff-d98052d52046", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 4.3.30.RELEASE-tuxcare.4 of org.springframework:spring-webmvc." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@4.3.30.RELEASE-tuxcare.4" } ] }