{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e8f6021d-f307-5b88-b4c8-5352d8a4f546", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:99d23da8-bd8d-5f4b-b584-b3758d614789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0c8dee5-6ae3-5e95-91cf-468a47bab29a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6569a984-f9df-5698-be31-15b80b2f5817", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dede90b0-46c1-5143-aad2-27f3c6c8a85a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd8c07bc-76ef-5e68-bc94-ae8c82736ca7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:09255b8f-546c-5daf-836f-05d7ca4e02b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8449da30-cb30-5fe2-82e6-63eb39901b2f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2356ceb0-e999-54a4-ae64-2d30a35c388d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:702de6b8-3b08-573d-8651-aadf0553b149", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:48f52248-f0e0-54bd-bd49-f6f5e9a78040", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad8f89e7-8f0b-5ac1-861c-47db68644c67", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:233f3544-7953-5f1f-9986-12f2db9bb8db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:886a1344-16e6-5aec-8eb2-60403622b5a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7dd669e8-901e-5572-98b9-db318065dcf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:83392ed8-76ea-5ca7-b68e-870efb540916", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:08021d0c-fb5e-5f36-9d51-d8b56a35aa20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7bc849bc-d2b0-5cd4-ae9d-578a521a23e7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1550d763-6a7d-551b-a412-170389f77066", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1190f046-6c50-5e2a-a75e-80e9993581e2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4512abea-63a2-591c-8d3e-ee31b9bf610e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab003944-1b35-520f-abcf-1c3444ca567d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c0d82c1-b667-5d02-b278-218495bfd158", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d515a62-07f4-58e8-851b-451e595f2143", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7c35647-5284-5bcd-abbb-d797fabc0d3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d0efd844-2349-52e4-9613-cbf8b7e324d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:980d767c-b93e-5509-b7a2-24b809c7d66d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a5bd300-f165-5890-ba97-234736ab7010", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c328c58-56e6-564c-a3f5-ff71fc7e0a36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2fd271ed-88fc-5f91-aaed-c01a1e76d5b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f748d186-ecea-5200-89ac-816642fb7448", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55f3ecaa-7497-5bca-89f7-e15e4135168b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ff24110-853c-5320-9c63-3762c998f5af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7cb0f6b1-2c5d-59e7-9c07-d69bcd059ee3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:770e3370-06a2-59e9-88f3-7fd5382e1dad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bba8d779-bdea-5400-b5a7-a55fc027e6cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da4f1f8d-709d-5a92-a0c2-25bbe6582c48", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce228934-1e73-5b53-a69f-3273c18d6cc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:452c1e90-a13d-5e12-99df-bb18f1acb339", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:535cc5e7-7f9b-5850-93d0-8788536628dd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:61f42516-107c-5010-99e5-56ce7183f1db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53f268ff-ac47-5059-8c9a-8c6447929674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b10d01c9-ca5c-5e2a-9ba5-7f4d1a890171", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7476aec6-c8ee-5b03-996d-fd1818b1d7f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2a295da-a32a-5e30-a477-a8d8bd70fd20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f4c88794-6141-593a-a57e-8fc3a5a05193", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:220241da-d34f-517a-a490-48f248d63e1b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d487bc7-b92c-5596-b7b6-c2145e8755b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad360706-f1cc-5097-9db8-59ae7a881f5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7c3763ec-47d3-584a-be28-220ab8d060a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e8a0cdc6-6481-5f07-91a0-7951b9edc84a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5718f47f-8c26-55b8-9364-e041234608cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ce4d4c3-1a17-5815-b48a-bf82cd3b3aa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:921aa12a-4a58-59cc-868d-2712ca18d01f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ac4b395-36bf-5c12-b3aa-903105a657b0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40122c37-b54c-5d80-9715-ac1f37987786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cae5a582-76c9-5206-8d1c-11f3228224e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:38e18dd0-d0e0-5df2-8255-a326c8ed6249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f1cc5ad-4ed4-55bb-94ab-9d99c009e288", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c27b29f0-9de1-5b8f-a264-4bf087086e73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.10.RELEASE-tuxcare.2" } ] }