{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5b489f39-7914-5f21-b141-209a8c18e47c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-aop", "purl": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7993bd0d-56d1-5797-bb74-c96ad3d62920", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:90a92135-4fd4-5fd5-b559-5d99e49b283a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3316aa91-bdcb-5a54-82b3-6be068db09de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd42349e-a143-54bf-8cd3-4e60049afabd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fe166543-0b13-5f9c-b2f1-7e2aace36b88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7c0555eb-9a09-5ec1-8d10-5ba10bd7f408", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:15d635d4-d87f-5a2b-8b1a-9e36dd72b7b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9075df9-0e8e-5167-94ae-575dfa171067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d524e579-bb07-5571-94bb-5ced73e90284", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80a95254-d317-50f7-ac5a-ce9af5830795", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:30277e70-05a5-59f7-a5da-dfe0e10eb4fe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7409b9e4-2cbe-52eb-a185-0bc4b6dd5263", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f26a1e01-194c-59cd-bdd0-630065349e2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:131df8eb-80b8-5642-b444-05cff5d08d8c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22a54ff9-b7df-5fd5-8717-2ab1918157da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e20036f-15ad-510f-80a4-df48dd42c6d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:16827e48-6a99-5cfb-8d11-7f11e2f7f721", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6ed4dc3-3cf0-5fca-b095-b959e4999326", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:57037e53-75e8-5613-b747-0b48be3b9a48", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:903e04d8-87e8-5138-be77-4a1371ac27b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0910f9ec-0039-5cf0-b4df-7350a07550f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4bff2ddb-8a12-53e3-a42f-2d12d5200ff4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa70bc95-5bda-5276-a134-6cec2fc9ee71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0927128-e06e-579d-9221-4e814b54da3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cd66d95c-20d0-5180-8bb8-991518887e9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c00d82ad-f1ab-5800-9038-a6c5500ab8bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53fb80ec-9191-5175-9d42-dd482c197d9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da649087-1c2c-5b87-975d-8772b73df557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0033b167-76ba-56a3-af12-8327887c74d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0b98b101-f201-5021-bcc7-422401278363", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2f931f4-011c-57fe-8f18-c07baa0a99d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:65ca5b05-a641-5a79-98a2-7c8717c271bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eddcb5a5-dc82-52b5-812a-072e59d18dd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9de51e35-be1d-5397-8663-b72a20dc10c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:618fd30b-7f96-5208-bab6-20596a657a34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3def8e3-97f0-5034-a5fb-33bb734e0cf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:745a008a-1bbe-52a0-a6c0-e4f38771648e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1adb8bc-7a23-50dc-9559-1471a2156604", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8288509b-b51b-5f7d-a640-5dc8d35404d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:991b5b9f-cebc-5c70-843e-7c581bab5ded", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:216b3430-1102-55d0-a473-d8453184995c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e2e3f44-6295-5690-82e9-92917bbc178a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aaaad25c-83b0-5f1d-87ea-a203bfa7952b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23464fd4-4c55-5871-978b-e75faff65f4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ecc29398-0d09-5066-a80e-c0439cb2739e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:299d1918-0cee-5742-bb68-3d87a1683503", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80494dff-d7f3-5e70-9b88-fec20cc18941", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:41cfb752-a54c-521e-acd1-c1261ab904a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd5d5949-cadc-5c7a-9771-7fb9007b82c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:849294c4-43a9-5450-b911-435e27e10212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f7c01f2-511d-548b-8d86-48d5212d5811", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:09cd8c9c-4f56-547a-aae6-e0d7fa693bc2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d8af551-ad46-5065-86ae-cd9983521a37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:01cd5637-8859-5be4-8267-369965039cc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ae732dd-00ee-51d5-a380-d9881c91c9ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06ef4b46-d99a-559c-b80f-c8e210cf39a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6747b3e1-7971-588c-ae94-6e6d8e0be09b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d963444-73fc-5315-8155-c1bc95646d3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5168e3b3-1d2f-5171-961d-18edb14f4d6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-aop." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aop@5.2.10.RELEASE-tuxcare.2" } ] }