{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:be755be3-40dc-5cad-a948-501a439c8299", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context", "purl": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6e64a063-4319-587e-92a7-29fd5fc04051", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29b82199-52ad-5f5e-82d2-edf8e8364ac6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9290c315-56d8-5f06-ad0b-f2844d80b190", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa713a9c-4978-553c-8914-fc2a18555369", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94c36545-1e66-5d38-9e53-0ff2318eb35f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bd77424-4c03-50ec-94b8-1f39a51003ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98b51034-ce0e-554d-9219-dbb1afca7aef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c626b73-9e6f-5011-8fa5-503bdfd38e43", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c5600d72-f5ec-5171-8e60-4cc59694821a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eefd8fbf-5b41-5d9a-ae0a-e82a9538547f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cb2a332-6089-527f-92a8-f49dc7e12804", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:578eeb44-820a-536b-9239-1964a7af0c63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2c353444-c738-5c76-bf08-eb61b3ae445d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b065402-2707-5dff-b911-d6fdc0568315", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ea56a8c-9ffa-5656-aec5-b38ecfd38aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6cc065fb-5af0-57af-900a-515cc095c5eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ebdab040-8170-5efd-b61c-33c709bfbcb9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8117254c-7411-53f3-be10-c7a0cb753481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ea3087c-6ab9-59f6-b499-8842de7b04fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf5d22c9-fe38-5a49-bd78-fe88dabde8a3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5fdb02d2-76cc-54cf-a643-437c53a55bcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:773402ce-9d96-504e-b75b-b0e524e8571a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:113688bb-6721-53cd-b6f1-8a6eb1c864bf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d986bbde-ab52-500e-8513-7dc2a2f5a38f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62c71b5a-ed08-5aac-97bf-7c367762850a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ed6a5d2-d97f-57aa-b5a0-1b4f484252f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:759e2041-65fb-5204-914c-00e264856580", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d48fd15-5426-5d71-b97b-bfa5275c5e92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e317495-0317-5ce4-9332-9375111e3f97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0bde1423-bf67-5324-b6f7-ea3a2a5905f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f1ad63f4-42a2-590b-bdf4-81dc103ba1de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55035b85-f33b-57ac-92fc-d94e237966b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eea7a6a9-229e-5fa8-8e99-a6d3c8dda55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d59607f4-ce79-5357-a358-46b974863267", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d694a540-3a9d-59ed-beaf-6eb4a97005dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8e03b87-9aad-5ca3-a66f-227bcfcf30a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:01a6b249-b449-5e1f-bffa-3754afad0898", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19bea7bc-061c-5456-aa5f-c146ee42b062", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be703756-a12c-5c11-bcb9-a23dc0f5cc64", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:acc8ce5a-3197-550f-bdcd-65431af95535", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ce59e03-11ca-5526-8ff2-df511500cbe9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5acaf95-37aa-5d9d-86d9-50ae14262a0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24eeb106-e225-510d-9655-696c593f5f0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74cae595-80f6-5fae-9ac5-562ab97b45b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12e09389-791e-5cba-a9a6-1659bd52e7e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f4390292-0043-559b-83fc-18b0db43feb1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9b5530a3-1223-56f2-ba78-b8335e122e69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:278ece94-3ae3-5ec3-b368-2d3909034562", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c6650fa7-7c3c-5092-9b10-627f1a0b279a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f846a0d3-796d-5578-af1f-a1ec35a32ffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf26dbe1-9334-58be-8c79-6a487c0900db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b681d51-64a1-56cb-adbe-8d61d17acecd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:32ddc768-58be-5d72-8e45-6c0ec2ecd900", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c7e23e92-106a-577c-b0ce-69194f93791f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9db97e64-8015-5375-876c-5b321a29dd45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:51a35562-6ffa-524e-9495-f0de923bc7c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1349e2ef-6287-5f6d-9af5-9763177b9b8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3476ae51-5dd4-523b-b3e4-1485f784ea47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1d26f5f-7146-53c7-8e21-185d39763b99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a607cb2f-32d3-53e7-b22c-d0d9525b89c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6494a8cb-7947-5437-a703-cc7477a07cce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e8ca9334-cdc3-5392-a483-979ac74ece8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context@5.2.8.RELEASE-tuxcare.2" } ] }