{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:21c73b66-d978-5235-b1e0-8a185be297cf", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:662a9521-3fb0-593b-86a6-54ef7fd2ee99", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:199273c0-c791-5edf-9f2f-f0e70e835113", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfc05491-9742-525a-822a-2153d2c12ea5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3fc8c61b-0b0c-5371-8e81-7a97d4b022ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1be544ba-0fe0-5a91-adf8-a80e6633f933", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:540d58f7-5fdc-54e1-bc63-f172bfc30b7e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5130cc2c-dbf5-5b73-b859-26e2a0b349f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e099b883-f8b8-5594-8d9c-cd49a3ec0d6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c837535f-d8f0-5d29-ae8b-2e83857a9ec6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:423b620e-7452-5881-8de5-91d7d5f0a23b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:380ba70c-0b33-5f79-b475-1b6ead9dc1f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:76b449b4-c576-5d67-a865-7bab37453809", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:795f6e9b-99b5-53e1-8d0c-d71a03cf3bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:961f55b1-3c81-5296-b79f-dd00a1554537", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:145a58dc-7b80-52ed-85e2-f7ce5989bfbc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ca7aea9-6474-5997-8fcf-69247b38ef8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91dd5fa0-a674-54d4-8f03-66f006ad2923", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ac4033d-5302-5e0d-a1b3-80d669130932", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:01aa9873-95a8-5571-85a7-9d75c336a839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3effbea7-33e3-5b85-aa7a-25535d6b1c8f", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b13741f5-2a03-5c01-95da-5785bce72b65", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d19a8e4f-e8dc-5a59-864a-817740e1d05d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3c31553-f128-5a2c-b7c8-b22ac211dd7d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a1e7945-143f-53cb-9d23-61d96a8367d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dbc534bb-82d8-5f42-80f2-2548be0bd1d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9eceb507-0165-592b-aa4f-68ce25e10cae", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aba4e131-79f1-5b9c-be2f-ad268e98c377", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6ba1b27-c822-59dc-91ab-5cc2ddf9fb2a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9ec62d87-75a7-58e0-a65c-5c75d946c9f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c4e6c86d-001d-53d1-af0c-489e73b18d2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9162876f-2b0e-5e87-bcb4-63c33c758b4b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3dfcf4c-af0f-5a65-83e9-f245b393f829", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d717f294-3ea7-5fe2-86a1-0df4e0a89142", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:541d5aa3-21fe-516f-9a69-ed1e1b69d882", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f625d3a7-2de4-5e6b-b33e-ed4a20526662", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9122ae0a-887e-545c-bd7f-c5fd2cebe3d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3100b18a-7b1a-586a-b9e0-d2a65d29e2f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c42acf1f-9c72-55ca-a067-49327f456589", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5ad7b082-efc8-5d99-ae0c-f79bbb1500fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27f06026-d8dd-50df-a2af-33ca6c03de1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fde38e8f-d983-5753-a8a9-9b938f586475", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5152d755-50f4-5206-b991-f537f85187a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc2a1701-4548-515a-9fdc-004d74e6fe98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af6dbdb7-4f89-5236-9a1f-4571e1f20eea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:78143075-508a-5b28-bfbb-8a5d13f21448", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f4a9b727-bf11-57d8-8d3c-14fe6c72dbf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf3c2212-545d-51c0-b20f-f3d5851582ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4c7e8c3-d312-5a31-82a6-18ae34a22451", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7e0c5363-0384-5ea3-b7fb-a4c54b2af969", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:08d61f3c-217d-5fa7-9405-0c20be8de6cd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af657d91-3c87-5d6d-81b0-eaa69bf4f8f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fcae27e3-2b46-5287-9e4c-3b8423eb1f7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:764da8e1-40ee-5b68-9e79-61a18e038eb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a7c35ff4-6b4c-5b2f-9700-c8290d2eeae0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:50555d5d-7684-5ae5-be9a-41969637e3b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6bf35e5-ec94-5d74-9aa9-184ae6c6a622", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a5fb941-6632-5c7d-96b6-575d3b6b9cf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ea5695d-c69c-5d76-be4e-643291c7fd17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b73dcf5-dc98-5365-945f-25d420720df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:517dbc1c-2f6b-5c59-bac2-67ccf7441e6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0919630-b715-50dc-82fd-92aeaaa4d3d4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e6ae0607-4f3b-57dc-a8c8-516e14681785", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.2.8.RELEASE-tuxcare.2" } ] }