{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:fcb422e8-d9cc-58c1-8630-2a53d08e13e4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-indexer", "purl": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:77c68aec-799f-508e-9e66-cb23156686c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f63707c7-aefa-594f-9ace-b83a2d8f70e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:410e4f3c-90e0-5c00-958e-2fd8300c92ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:327d834d-7791-5ce2-a4d2-ac8868962ae4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2f34667c-9b79-561f-8f25-1ac084ae68ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6518fbf-d079-512e-a615-68f16fb4ea07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f66efa95-0950-525c-9ddc-3601229eb5ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7aca4382-da79-59bd-a8db-07df6fe68e92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d8fe11fd-6fba-59b7-a9a7-50f2382a093a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3bd41f0-bde8-5f9e-8c25-a59988aab053", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:08620947-1abe-59cc-998e-a6329d335b69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d8734bb-1a5e-5f4a-ad01-1dac5abebe36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac6c2c3c-e69d-5740-96c1-1c88786ec310", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de323313-ff14-5b95-a77a-86bee94f277b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40f9761c-9ae2-5a3d-af18-aab09fdbdc42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5772b29-3e3a-5bec-9d60-327ee4c81665", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bce0051d-d655-58de-b4b2-f1f925bde870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0aed24af-235f-5dfe-9200-cfc872c29315", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e48217a8-04a2-51dc-8a90-a5270bf9ddbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f56599fe-214b-565f-812d-8edb6dbeef42", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be2a76d5-f545-588b-a9e2-e87e34d24422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a91b4f1c-fdec-5d22-ad94-64949af72f86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9c3c0a3-46d6-5666-aa4f-cbdfe9f1590f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97471aa4-96b7-54fc-b67a-1ad175d71762", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae311e6c-82d3-54d0-bed2-2f71ce0a5cbb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:698717a1-3467-550b-a251-8aadb2217f1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04623de9-b098-5a79-8a62-964b2e2618a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1bcbc65f-f180-57dc-80f5-5db8a3ff9789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bfff8fc-4f88-55d6-999e-90f87b46c78f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d3b799c1-9092-53b3-945a-42e7bf55fce2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:430f023b-391b-58f9-b78d-ea389a177d8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a64b7183-81b1-52b0-ad71-4bf4784f1dfd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cc7f46ff-25e3-5029-8003-e83f1d89d8ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0e03ea9-5d14-596a-a8a8-41fd96d7581d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dcffb24a-f4ed-5528-b79a-10fb063f4e6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:daea3a1e-c441-5846-964b-810c5984e37d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:20a9bf18-3ce9-5905-857e-9ca57299d9f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80581b17-151e-514c-aab1-66ed0f0b3f6b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ef1805e-c4b5-5d3d-9198-9da168bd98bd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f84a4984-d141-54b6-8d1d-01717a866baf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6c907c6-d7ad-514c-9da5-1fc812563633", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:32450ba6-6f6d-5050-9212-51449644db8e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3c67ea7-8648-5452-8d5e-84f8a70bda7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7afc0d50-d65e-5dda-b7a5-706c57f7fcea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:79215e94-0437-5bb4-a3b3-c4acbd9c1f43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0a86888a-13c1-5ed3-8f45-9c2d878add84", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da42e801-4a6b-57ff-a001-5b99a5ac4b6c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1eada76-b5a8-5236-9762-7b1485e0a31e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fdf3f550-5aac-536a-86a6-eb7c17a0e390", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c58bf17b-52b5-55f4-acc9-589a0e94976f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f729b5cc-5adc-5b75-a224-867cf22b9e14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b622354-2dab-5ff2-b4fe-a650dbd7a393", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f1353ef-0e6a-56a5-8b0d-3a861a11c3a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:49ac0496-d578-5bd3-a7b7-82a93f0afbd0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70d5450b-ee13-5cd6-a22b-fe3e3313aedc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:07db0650-f290-5d4b-bb69-0fe699909391", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:087b1143-a808-54fd-9436-dbe60eb4a74e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a136d38b-95e4-5bce-a65e-c11311428e95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ed080e2-e488-522b-9484-0e87591d54a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfbb3af5-f3ee-5c1f-8f1f-934b41a42a1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cdb13dd-8daa-5285-a6b8-169ef7a033a7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87238b8b-17d3-59a5-a927-b5f140bf5fa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-indexer." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-indexer@5.2.8.RELEASE-tuxcare.2" } ] }