{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3ef1265a-c4ed-5fc7-8b64-f67cc581e9ab", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-instrument", "purl": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7079e771-2d25-5ef3-bb16-b5ff94208db9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df1cf691-d086-5162-b18a-7e963a7d88eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3a8d2c6-d9a7-55b7-a2e4-c0fc1f0dac81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:587ccf5e-3c8f-521b-b9bf-c919751f28e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6be121a3-7f12-5429-a0fc-13546344bb34", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9f2b0bd-d801-5cff-b0c7-92baa28d3dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4ee05e1-9095-53f0-9f6b-9b5780ca9fe1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:63a4c479-5270-5af8-9923-e04f324cfc7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d04dbe40-2fe9-5592-a4a4-788caf09cfda", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8732e238-d95f-5a0e-a749-bb458d1df8f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6afbc6c7-d9aa-550b-b049-b6f89793fde0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9331e770-3efa-56a9-b034-1bc7978ce80d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba906a66-74e9-5e49-8638-3809108aca9e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:365d1d82-474d-5ebf-aa90-72312fa82d29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10cc448c-5559-5608-b1b5-ab65f80e93a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af9b62a8-9dcd-5784-8bf5-6dac7823f79a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e4835c7-cb4d-5bfd-91ff-c0328babb5ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:865b48db-9f97-5720-bcc4-7f5b84c2c3ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:36db3fdd-5959-5803-9afa-396e37c77b08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:25ed31d2-b65c-5802-b4b6-298eca5e1386", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbd0ec61-93a8-5827-a779-82b79a58bf5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40d95f6c-fbe1-52a4-b154-f3ece4555d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:31517090-445d-5777-a631-86a4c80f524d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03f34995-de91-5a2b-afdd-69cb52ec9f76", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af4042e1-aa71-5671-b3a0-679d25a582ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:59ca53e1-f1bd-5a3c-9765-d1b99b995f9c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ee35536f-b3fb-5733-94f1-babefa475549", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b8303679-9e1e-5fd1-bde4-45290a2161af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ffc4890-206d-5108-965a-e14e732f4d57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:07170393-6d7d-5dd7-9910-5a201f868930", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d020e005-93f2-5451-a1fb-5085ab9031bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72e95568-5b96-56f3-8c50-d0769513e0aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:320cc065-fca1-5bd8-8b16-b7b8a921493e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96e4c283-b618-5df1-82dc-52a1363c8983", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:66da1f55-88e0-5532-9dc7-7529723fd818", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56d21568-0123-519d-8047-90ff0a0df7c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc07e2e2-a691-546b-a31a-6ca9b35ac076", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bac417ff-c57a-5a54-8dcd-8cab17b6734b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:17ec1f75-dcf6-5782-9f1f-52daf1a6532c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:78f7ed1f-f7a4-557e-8f6c-21acf73e761a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39e83408-23da-5d85-8943-36ab5c99ec31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:500dfc4c-826c-5758-812e-c052e5b483e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b132fff-256d-5ad5-a263-9fd069ed9a7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ef2d1083-577e-5f63-a67f-7282376c971c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f94a541-26b0-5bfc-a210-fda025976dbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b18b4cec-d7f1-5d5a-a003-42bb7d6600a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ba071be-e4ff-547d-8d6f-0ec387fc6108", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b64957ed-1d28-5662-ba3f-999a4a8be032", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7599a023-c35d-5ce1-b2f9-8d775653f3ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:621c31c4-f6ec-5000-bbee-7d52016bedc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9e1a0dbc-6609-5e4b-9700-4bfa3df91543", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b700fc31-49cd-529f-9487-df32eb6abf27", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:729be717-72a1-5c7a-b828-b768ce391f5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6d85d77-7be7-5309-bc1b-1df11607ad6d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eba8173d-4acd-5ab8-8236-19e79b030f7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:68e6db9e-bbe1-5e7c-a640-037daaec23e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:84801afd-c52e-5168-aba3-6149f0444587", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:608ef30a-c9b0-5a1d-949e-4609a4371b43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:880fb353-980b-5b4b-bd74-c06143927a8f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:563c6e11-e269-55e9-9d26-cbfd69c5649b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b2e97e0-567e-5a1e-ba16-791a58cba13d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cb23cf0-5316-5f0d-bf44-b59cbf28877c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-instrument." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-instrument@5.2.8.RELEASE-tuxcare.2" } ] }