{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0ad2239c-a2c3-58db-b390-b2fa4f67d337", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-aspects", "purl": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:13acaae6-f084-532a-8db5-de75560dcf70", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:38c6553a-4212-5592-a189-c2cede230d29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86a35426-19ba-527d-86ac-661fdadc4e4c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f9ba270-b7de-59da-aa69-c408b682e562", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2b42b535-9650-543a-980c-037f83cf3750", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f953760a-a837-5ed7-b433-26851f4fcaeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70a7f0f1-80c3-56a4-b278-0b19a09964db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab1b9764-474f-59e6-a56f-8cd93167c17c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a27fd80e-1a14-53e4-9c6d-be3bc4c429d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6897778-3d97-5752-8cc5-55ff8cd64142", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ca50768-800e-5933-9c76-2e6f026b90b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:67af8e42-e2f3-5c19-b0bf-af2b4a2f8cb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:34f7d219-74d1-58f9-8648-88b17d658419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:089ec7e2-8799-5a5a-ac43-3a77f8f042aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9f865ae6-45b3-5626-8189-e39f3a058bb5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a649312d-3086-530a-847c-c7908bb2681d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cb921e5a-212d-50df-9437-af9f1b2bc51d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eddcc0f2-aa7d-516f-8f9e-2ac8ae6ae077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6502f94-79c5-5bf0-8f0d-66916b726748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b89781f3-433c-55b2-9aa2-d7d6ca6ac457", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b4596c6-3d9b-50ef-acb7-13eaebf1779d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae2d5e47-e7b2-5f39-8137-4b938669ac91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c537d6c-e7c9-5a87-baae-ee5f4cbda319", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf5d554d-b1e4-53ba-8ee6-2aefd09ce8f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0299ac41-4186-59b6-9309-dbeaf92f864b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b51ec68-553a-58fe-93d3-a0141ec7bf77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d0b0517-7892-52b8-a97a-c5bacaec984c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:302bc503-51ba-581d-b279-77beb7911ef3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22b2906f-efde-51b0-b467-2814628ee2e7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81d163d0-70be-5a74-ac75-be48f30d825e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:160e66c0-07f3-54b5-9a74-1a1770fc245a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e78f83ec-b9da-521d-8b19-4a4cc837b51f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:088ed947-79ae-5dbb-b83a-accf06f3f1b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:046439c3-b2f7-5d5d-a77e-03aaf3c70a6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04792b2b-95c9-5f74-a517-b51557b64487", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4289be9f-2ad0-55e8-8f9e-1d32a1fb8cf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb69e54c-404c-53cd-884e-7740a56a657c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:917a0de4-1627-514c-9bfd-23f3f6187d65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f30fb359-4702-5ba2-abc2-63c498293a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff72590b-b98f-59a1-90ca-343f7a07d38a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6841ac27-9e96-51bd-af7b-3cc221029f96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:84b38705-ee59-5dea-922f-8d4795149357", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d5d8cf09-c361-508e-8541-6a78657293f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c77ec67c-3713-5633-98ae-be0e5c614b34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64b4a423-5fac-52fe-a486-cf32fde699b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac463f2e-88ed-56c4-9e29-369b76d11e2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28de4e89-9361-57fa-84e6-514cb217110e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f7979e75-3e7a-5bad-b923-788fffffe2e1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eef873d0-120c-51ff-9613-1e23e4a41ce7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:58b6d85e-e5da-55c7-a573-d798c3ebab6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e7c0673-333a-576b-a7d9-bd4a06a28a15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fe2a6f3d-6400-579e-a3f2-1783d1ae0b2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2c620c28-9fd5-56d7-8f71-1c8c37709e7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:43bb6262-829a-5936-b93d-efe1835b4b02", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5bc497d6-d4bd-537e-9b32-65d538f5dde6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af4cb7bc-2af0-5ed1-a495-2a4f66d52cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:825e1483-6df8-5078-88b3-9f06b252dfa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5df492fa-45fe-5fe4-ac28-7fe953b61075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db8f5e9f-d23d-5f49-8f48-df85eec115a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3f912c2a-cf4d-5663-8ad1-4d8c6f67bde1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86b054e1-194b-5e1b-999a-529902d98a1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ef1be9f2-cfc7-5b76-a91f-1b91e059c0ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-aspects." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-aspects@5.2.8.RELEASE-tuxcare.2" } ] }