{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:7313005d-fbd7-51de-af74-be064339f979", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a6291a1-034e-54c3-99d0-e0e64c181a7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:547dca27-0e80-5bbf-8bac-64bd699db658", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fbfe5046-49ef-5736-8ca9-f306d9a071b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cea1d5fc-476f-56fe-bd31-5e501757d1e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2853c36f-9e40-5f7f-b433-280309ac988b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db3f525c-e189-56f7-a511-175201ab1b21", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:572dcfff-ba38-5b82-899b-5fc4729891f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2c39a852-74f0-5ba1-94ba-606a64ed3753", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9529070-6383-5a0e-80b6-f908a619747b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:352af51b-2359-5836-b415-98978342ee88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62ea0140-e484-5f60-b9a2-5eb0caf9ae7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53b024c6-4d31-5c33-8588-6cf09e608b61", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3c91695-67fa-5079-9985-1ca82e8dd6b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2f3168a0-1c00-587b-94d6-f99f055b8938", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:380498ba-4c38-5345-b34e-037f535a670d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ab72e1f-dcac-5e9a-bd01-dbb9c47c8f33", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22386b22-3825-5680-9c4d-b673837f6bed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf731434-773d-5188-9962-aa512facec13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fceb18db-dafd-5480-b900-abe043d3b973", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b0152e64-1c42-547f-95a1-478d13531926", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4da213d8-35d2-5956-aee0-7fe35e5f986b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0b239af-d1d7-50aa-8456-9f0bbf4c7d4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5af592fd-b61d-52f7-aa6c-2c3938a5787e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:17ae1ac1-2230-5e66-9eea-4c388e91d637", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d91be488-31f2-5d82-8ef7-d85dbb675eec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81f3b5e0-b177-5665-9b91-f538ee32db07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b2a0ed28-8e0f-5561-bd0d-c2e30f3fda00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d213a3c-2e1d-5cad-a374-df6111b6ec88", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4da54b34-6158-5aaa-a88c-c5b07cec8e81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4c726d5-106d-5207-9cb6-ef2525b7d49c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d58a2a8d-a134-59fc-ad81-a01f824a523d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a92faded-b84c-58f4-87fc-d8a8ae4d1099", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cdc8452a-e3c9-550f-8d96-701d885fc172", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b0a2673-7d0c-5867-9732-a0e938e30522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a56a40f6-411b-5245-b247-69c0619328b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba3dbfb8-3ffe-5a41-87d4-55b1fb560e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d212818b-c032-5566-8d45-89f58b313fb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ab03bae-bdb0-5ec9-8152-0f100c55ebcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f323cd17-d1bd-577a-b050-6b9f0abf402b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7570091b-dc81-5ce6-b610-3b4701605313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c72fcec-7174-54e8-8162-e1526f029ad0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a21d268d-085b-5bba-834a-d8627973f10c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7d41d81-92f8-537e-90b5-23a0a1565c8b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c32bac80-223a-51b6-b116-83fbf4a489c5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cc2ae6f-d321-547d-b4f1-645ecb011f05", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6fdd948-171c-566a-ac91-58969514ef97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04008d66-75f4-5d99-9619-65cbc22838d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a074b1cf-58b9-5941-9bf6-7dda299cf97c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82aa87c9-dcc3-5a68-936a-0f770ba21cd7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:49cddef1-28c4-5749-8365-73eb7d2f368d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f075c0c-57d7-547c-a2c9-f0bbaf8e508b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:311b09d4-5801-5cb9-9412-0de06c7b4788", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ebad7d9-1d2e-5b4d-9c66-71396277b723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:90b19812-682a-5ab2-a3f2-1fe6666bf232", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04e6d08b-0e95-5b19-ade6-92708edcd747", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:13417c66-5312-5ced-961c-32de17ef6466", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b6edfb8-8669-55f8-a536-8bc091ccf2cb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1a37bcc0-3826-5f82-a732-912cdf94330b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca1386a7-1735-568a-9222-f47c4ff138c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.10.RELEASE-tuxcare.2" } ] }