{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f4355e65-e7c0-554c-bb01-7d4713364dd3", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:694f4e42-ad47-5270-a536-3015119d29d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:219eeff3-31b2-5de6-afd8-d9888b5da79e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0c6fcc5-c1cb-5f15-b3c3-2d8e9b0512fb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95b2148d-48a8-53c8-8643-97f706fb5d3a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f8f5e0e-c444-5400-99ef-d881793aeb81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72ca0c37-89e5-59ec-87c2-cf83535ca7c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4496ef91-3f54-5edd-9ed8-96f4009590d0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b8859ec-8618-5a4a-a047-168b4cae786d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:453aa35c-75fd-5df8-936b-fafa2a806e44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb1b5c69-7761-58fd-8ba8-9a6ac2b5f7cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:899ea0d8-6cb1-59ae-b371-35a7d922265c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de574e68-f516-5ef5-9ddc-ca5f6fee4ed4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5932f7c3-39ac-5dcb-9019-837f4ac36417", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a73b249-96b0-52aa-be10-436b33c0b6cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8a0cd8e9-bc11-5499-a1f0-30899d4ee043", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d01174c-a2c8-5fce-bb91-b1be417e6012", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b794f1ce-0086-5dd7-b4d3-f9ff1dac8b1d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4beafdc2-9356-5709-857a-bf4c6345fa8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9edddf13-bae8-59a5-a0b5-7dc1dc9bbd12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a4c29a71-02cf-50d5-8b59-61b75ad8aed0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd3ab2d4-e69d-5aab-a97c-cc9db36fb775", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:25ef82da-f51b-56a9-b6b3-6fa9224a341f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e6888139-0a63-5c03-9ea8-b833ceef7bc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbc0bd52-3383-54ed-b725-456093c6e8dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2622f6ae-c974-5bb4-a2e2-f1ee111cc7b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1de7e72f-6f49-55fa-b3f4-4d80999aee98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28277cb1-0715-52c1-9d69-4d36c26a6802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c9bc7207-5994-5441-b738-d89d9ae4606e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:93f9eb8c-461f-50b4-a832-16714c8c372d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7683019-4f7c-56fb-9a7b-91ca7a871162", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d9f9b688-83f2-5044-a340-c2b98e0c2a78", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd83bd27-6b00-57be-a5cf-c1f74288b515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:58892a82-991d-5a57-bce3-886054fa3564", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e040ac3-c272-5cc5-9950-613de12275b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd7e8159-0726-50ff-aaf5-6d2eccd8e5f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be4f43a9-75e8-57e0-bfb5-71e34f6c0750", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23b0de41-566e-5cbd-8cde-4573087471c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2656f63-19fc-52e9-bfb1-f0b6e2fdb15f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:820dcb6e-d560-5969-8303-54b1b9b3bb38", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64d629dd-4335-5f7b-a3f4-383087a171de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:049f9e04-607f-5bb5-b4fc-ffd5206fefc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:77063253-1e77-523b-99c2-028ebea4a5a4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0646a9f1-5f30-5b26-8347-b9e71231c4f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39cc6c2e-d6a2-5fc5-a4e2-904c94e4d7ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3e0e4fb5-b991-52fd-b4dc-0453f25f8251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:92c7d680-a84c-5aa5-84f7-eed947debc5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b42267a9-c763-501e-89fa-f1e9fbb87e19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af30d995-2bf7-555c-b10d-296d59bf16c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cc5139bc-dfa9-5233-9db6-a06690141e91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39e2655a-0c30-5035-a2c4-499483758179", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fc738249-1825-570d-a399-94b5f3408249", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8f009472-89f5-5897-ae23-5dca1a3d4148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c81f647c-0662-5082-87a4-6ac2da0f2d4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10b9f72f-f1c0-56dc-95e8-04a7025d2501", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de1bfaaf-9ec5-5a63-bd15-279b6a068f27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4cb66cc5-f5a1-5fcd-a147-2a093ab3572b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d703faaf-d941-5761-82e5-bf9df747b1b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eca3625b-1712-5d02-985e-a962e13004ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:21eb746c-6817-55f0-99ac-965319a990d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.10.RELEASE-tuxcare.2" } ] }