{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2fd8667c-f1c9-519b-8d9d-57197558a3e6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-framework-bom", "purl": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ce8d9bb-293e-5cd6-8186-245f3bff9437", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3c266e7-ae21-561b-a512-a91a81bdc66b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4179e008-d004-52c5-adc7-38e4c7d25085", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:313569c8-7da3-5192-a701-0e9009af7a35", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5ed5f187-1a47-5347-a71e-70039e574f42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2f4f2028-c9fd-5116-ae71-e2ec5a42b35f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8972c82e-299d-53f5-a586-edc4e49a117b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a98ebaf2-83f1-59dc-a6c7-b7dcc2f2ebc6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f1e42b6-5687-52fb-8e79-46f821091272", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e60c8a6d-d3bb-5198-8080-bd9974e28387", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82a8f6f5-9be9-5ad3-8c0d-3d26553e0fa1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:086b332c-eb5f-5501-8028-a0211845036c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74a1cbe0-ad4a-5093-99ab-60a5d9e6e9ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c1f3cbe-8fce-5ace-bf13-e2f5cbe00c93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23cbd735-536d-5d3f-bd58-e764fd2333a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b9c5fb7-6c8d-5095-b61b-be5d565543c1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fff36c2b-dcc4-53d1-a959-468c8d4820ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4dea2680-e140-5765-aecf-2ffb8f170803", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5cfaa577-6379-5f12-9338-9f9ddf349c8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d039aa64-79e7-5587-b3c9-7d9861fde3b1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df262068-880c-58e7-98ac-5fd2166aacdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:05f02a15-bc5e-5619-ac8e-736294bc9f26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f390b7b8-638d-5ce3-aaea-0f447bd2de71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a71eb55b-e87f-5f78-ad31-039f4faaa7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ecd1dc5f-f7a0-5140-87ad-04aeeba33ad6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4168f39-fcb6-529f-993a-77af8fb6131a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e567e026-a994-5508-b903-aba7caa3b600", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b850c18e-d32f-5c8a-a352-5bdfc7bac7fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96b573ad-1f0a-5eff-8620-3d0583e4c386", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2e96a7b-bdd1-5e2f-9671-4cdc6b65427a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9d559d4-d19c-5523-a300-3349bcfbd53e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d69b3eb-7f78-5b34-b3ec-66079cd0c45f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:233ee29c-ec25-51f2-aa2d-4320a1b9d2d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c96e7760-dd1f-5898-93a4-7edadb4608a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d28141b7-9d47-539e-802a-16ce54c842a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9071ab95-c1ee-5e69-920a-5dd4242d9cc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3d9beea-f7d1-578d-9d0b-0ea83cf805c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd31fd6e-5f57-586f-ab4e-ba01bdf3204d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98c07ac7-9f98-5a54-a916-6e0e03a9b54e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8de389ca-1c0c-50ff-a064-4906f29919cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b93906cd-6ef8-5774-88ea-2ddc8d555042", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ba25b5b-4d7f-5fe0-9df7-9a73faa3b781", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:79e5a0d3-fa3d-52d5-9206-0c61da245664", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f27232fd-716d-5337-b982-dddc10ce08f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e3e0e91-a314-50b5-8a46-561b7b85c24e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2d93cd75-dea6-5e1e-8566-59a435e313be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3d5db54a-d5bc-5304-99d7-66efe585275a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:efe891df-331a-5cf4-bc05-2736617bb3af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bd8e1ec-8a19-55d9-95e3-1b48c16feef7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:382b125a-730f-5280-a602-7c5ae0e3b783", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:afc312c3-8aad-5d3b-a75e-4d2070324fa7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9f73aa2-b9b1-5679-9b03-aee8cf066064", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df84ae15-8b71-56ac-a619-e2b8013d67ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87285ac6-4dda-5c60-969c-3172ab005967", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bbcba2ba-26f0-5f24-9aae-5a504ce993b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c136ef8e-1af7-568b-aa7b-ab878e6deb8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:79c26adf-fbf6-533c-996d-a751c6db2f25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2df48058-c228-5122-bebc-bbd832753af7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91054412-cce5-5b13-843e-bb3e4a9887b3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e43d1c64-ffa5-5931-b9cb-54cee94ddbd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfb73351-b55f-542d-8ea4-2855719e9493", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d0378605-90d7-56f0-bb22-6ca490781f8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-framework-bom." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-framework-bom@5.2.8.RELEASE-tuxcare.2" } ] }