{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:b540f811-207b-5335-98f2-a892d35e994a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff41ea21-3990-5f41-9c48-dbfe324cbe41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e285b85-624e-5964-b7ba-920eb82979be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:14b45105-053a-5344-b0a5-3111cc5357da", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:00d692b2-6679-5168-8a90-ed118ae0b416", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19bb54a8-9ae7-5882-bda2-a0c15a1118f3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5436b282-b421-5915-a2f5-01049df39a1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ead7e684-4f5a-50db-88fa-330476f44033", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:26797e52-1e56-54e0-a525-5105f8a057f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c43e36c-e8f0-5183-adf4-fd1a05d224d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5ce49aa4-d75d-5dc6-b02a-034c3ff17cdb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:928b25ff-aecc-5d9a-b40b-d1d77beb7b97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98d642a1-2914-5f8a-9165-2292403aab93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ffa9cb32-fd96-5ac5-95e1-c1eba47fccc4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24086882-f145-5d24-abb9-89dc09ec5605", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e480e452-3719-55bf-9593-45df603afaee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:735394c7-f928-5c6c-b046-2b1510d5f49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:90f5bd72-d659-51c0-9fe1-bc1998618889", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d2b5406e-440c-5c2d-863f-30be764edd4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a1e7515d-8b18-595e-829c-70ac5a34b6df", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a2400f7-ab88-5776-8062-f65838cfc6e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:63838c5e-5b88-5bd5-b81c-c0e0579c2b83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87a24fc8-5a4e-5f92-bb58-aecf9dac6621", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c7e56b9-51f3-5d01-ac32-75b1d0bb235c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e33ce278-b33a-5f82-8402-4b86faff42b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80165fd3-331e-55e8-bfdf-28fb581749c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:576faf1c-b6d1-583b-a8f8-eb264b5b85d2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7faa15e5-6187-5056-aa98-79ae66c4dfed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa3ef946-13a7-5dc0-a4d1-8b962eff320b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ffbe92a8-3644-5f3d-b116-785eb3773200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5043720e-73d3-51cf-a33d-e1502a9c7813", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:69d52589-4076-5ee8-a52f-983ebea6832e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:778635f8-efca-57e1-b195-9635d9b1e718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:61369448-1c16-5b4d-9846-9e1db1ad5b41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98899403-82f4-5551-bbd0-d5baa08208a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28afa874-6dc1-5f72-b920-23ebc8d9b50d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a435bb27-e336-535b-b1b0-868c5942d830", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:36f4f4cc-ceb6-5452-9597-ae48bc15fcc9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:66e58163-1a69-5cf8-b43e-663ccdcc71d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2288aa4-45ed-573f-a2a3-dc0a2bef5981", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:128c63cc-3deb-5244-af6b-64ed139464c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:94e9b6e7-9996-5ee7-a28d-4f0aacf27242", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8910d9c9-e321-5543-b3ea-25a0374b70d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54b57f11-c7d6-5592-b434-953a9020214e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a1e7c3a-1ee7-51d1-a18a-24b9ee45eb03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db5e6f82-e377-59de-874e-c95c1ba9649b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:008a0e35-ff21-5f14-9604-50a877604358", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2888dddb-7067-5e89-933c-b6aaec9bcb5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:deed931d-a6ae-5d77-be46-496b5954179e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b8c24b35-cfb0-51e7-bd1e-1d2a7ed74237", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89c5043f-b6dc-5f39-9d6f-4b156e7fbc3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:51313753-cac4-5d24-9c22-a13427813798", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6c5e4a0f-151f-5ea5-a88b-54eec04bce16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5c1946f-30ef-57a3-a0b8-d2ff0c043fe9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dbf94b2f-7d40-52ea-9ec5-7921cc194be0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6d37012-95dc-5b83-b945-42d61cd62ad6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:366ba2d5-1f03-5233-9873-15e4c0c7be79", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:49c1a436-5f82-578d-8ecb-1f89ee674834", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9ccba506-217c-5fd3-9d4d-bff476f29af5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df2711ea-0b32-5a73-a801-7685f6ad0c12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.10.RELEASE-tuxcare.2" } ] }