{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:368dd383-7f66-51aa-b9d1-8b9b8d947794", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-beans", "purl": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12a742df-ffb9-5580-8a74-94466a255f33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fceefe25-6d91-5071-8a75-211e0e45e771", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5ffbf168-dabe-50b7-a1da-885e0d958073", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f7c03718-e4e3-53f1-b57c-e69a1f703d6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ecee1f9-d85f-59b9-a90f-ab64074aa53c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ddd05f9f-4660-5bdf-8389-9e1238785cc2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:462349e9-f246-580a-a782-1114c56dba62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4736597c-50c3-5f07-b085-55351aa471bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cb41139b-4b39-5bcc-8bf2-710d3899ea51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70e85162-55fc-5b00-9524-de8eccf3d608", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc7b2d36-b875-5447-81a5-607814819352", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b25b7a81-acf7-5e14-bbe5-e5815537773e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6c8b53cb-b46c-5d28-a061-d07c2a147e7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:387a7c5d-26eb-5884-b158-ba101fbaf9a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab7d7a5e-f171-5ebd-8ca0-3eb84e048dad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8eb9f0d0-37b7-5a61-9d4f-11b7aa32bf3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fdc4f8fd-d776-5d38-9d27-4912cc39f88c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea4e2dca-e84d-5a70-bdcc-5e62ba166c90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb208239-4045-5a52-8478-a0daff46dd9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9f6a302e-a42c-57db-aa28-abeab80d5b29", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73137aef-52c6-55b3-a067-279292602fd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a34868a4-5cbc-546e-9510-f73106137e0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:533f14a7-95fb-5a67-a82d-b357099335e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62b7306c-5c2f-5525-8cc8-4a4ba4b8fb55", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97ce3691-35c6-5ce7-a4bf-58429a5ac523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e37f67a1-acc5-5a5a-998b-1b0da085d66b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1132550-8863-5217-9a1d-a1860dce2b19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a14a4be-05e1-5b4d-af26-774f8daf8417", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab07d52e-cbc6-56ad-86f8-2836fa1c2309", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e571363-5bd5-5366-a246-94bff74d5c01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bef68556-69be-5874-9df3-634e51d056b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:adb20588-45a6-55b2-a86b-ae525a4c5b38", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2fb78d1-b787-576d-a565-3fd7f942175e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10be5b7b-b73b-56bf-8b37-91e175d74070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:719b81d7-340f-5497-b05b-b457643262ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a8f7881-b10c-5a22-adfd-f7e86211aaa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eed6e6b5-1716-5512-8da1-83ea76a3bce2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ad33ef0-114d-5482-8b72-b381e63ee2e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0e228e8b-f8b2-57ac-9f1c-ea1bafd2e30a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3726a64-a7a9-518a-99e3-19e65e34149c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:50ba1e8a-2a75-5f9e-975d-0f641abefbe2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9656e23d-5867-589f-b7be-e61b252f9ef9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ebe4a6bf-244f-55e1-85bb-60e1b0191018", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc50da28-e263-557f-aeed-466f59a320fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73b32d61-8758-56e7-b736-fe64639ad0c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:69460539-72be-520b-a77a-7e4359d0639c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d610ad3-68ee-59d4-a29d-dae5f486485c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c40e028f-b044-5e3a-bd0f-032ebe8397a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bcbefac9-4446-5179-9552-87cd4a54f33e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cf48c1e3-7ac3-522b-a279-30ca70efa795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c82cb9da-1c84-5c9b-9d28-795eabc60d6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c0153b26-6603-51b2-aad2-deba5fc3cea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f76fc033-1668-59b9-9d97-15f7b4f2e846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be85aa56-0cde-5853-8ab5-eda3887bd064", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89f7a163-1803-5917-b3fe-ac87bb6e9627", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d784f6d-0985-512f-82c8-511ec80a7fb4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0399970-0492-579d-81be-673077ec412b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3914451-8988-5102-bbd5-a1dcf303f27b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29c553c5-6921-5a73-9d1b-0afeaede9e96", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc71eff2-8215-5ba5-97b6-d1378ec7e12d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29ab5064-01f6-5e51-948e-1f47acd83308", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e2856e1-ef93-5550-a902-5b1218d45ff7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-beans." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-beans@5.2.8.RELEASE-tuxcare.2" } ] }