{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:860eb952-6f6b-5760-93d9-73781604fb90", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jcl", "purl": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24b7ed4b-510a-5d83-b2f0-6837399bd8ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7e8848e0-ecdd-54ab-a6a1-0b46abfba7ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3093891b-934b-5a20-9caa-c00ed79d923f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f27218d7-f955-5e92-b7aa-d05773863e9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1d0f1ec6-9c74-55c4-8408-d797163d5f1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eafb2c07-c55d-5382-a932-6c49bec481aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1e0b71b6-998d-544d-857d-2739c9856cf4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c9de1c8-0ae0-5a3a-b640-939acc2da74c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d14bfe8-87d7-56c4-9a3e-5ba87914ffd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e756494c-ea19-57b0-b9a7-9be7957b07c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04d9056d-6c21-5c8f-8b28-1d8feeebebd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4f04343-9fc5-5051-9ffe-cd1e8dc7798a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a251736a-7218-507f-8765-4015e6c3f6ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9c7c025-4d46-562c-8e2b-9f0a3daf7a3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f597f764-2a1a-55f0-a942-1ef1d54234cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b43773b-b152-5bf6-bb8c-efb23bbfcb56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3d36e02-e2d8-5879-93bf-febf7ec5e11d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5477b592-af69-51f5-8496-35756858632e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:51233a14-cfe0-5419-b7da-ed81020f4789", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7e8243f1-409a-5cf9-9bea-c3d3fe5ea003", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4dd779eb-5608-5a09-bc3a-91f176879f7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4aa0eaab-9ad8-504e-96de-58df33d4877d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c4c7124-0257-5b16-a704-d46ac1108127", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3501377c-b167-59de-b2ba-36c7fb24215a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:034ab869-debe-5fa3-9d93-0af449e22d2a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a3b79a2-ac8b-510a-9a3e-5ec1e6889e2c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fc338898-a35d-5870-b2fb-3c4ae1e4ba13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e651fa87-e749-591f-a27c-69c124a9599e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5362f037-99b1-53c6-9e8b-aab1c9d1e227", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b07bd86b-4e7a-5497-a187-a155a18eccec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e71bddfa-2aa9-5e16-876d-ecc8162935bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bfa5306e-97f0-522a-b16c-5a56bf5c0b35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3d9864a7-1e9a-56f6-af1d-d3abb744992d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a366bcf6-9d4a-5c19-8ed2-56e80aaf632c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:601cdfff-ec4d-5b7a-beb0-7b60bda13b0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40f99a1a-f6ae-5e88-b602-000501fe2b23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:71a6ded8-b929-51c0-81aa-9905be51e56b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd088ba8-135f-5457-bf33-4209496b55f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f98c959-6481-55e6-9069-5610142bcecd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:31228b6a-318f-5350-98fd-f9ebb54fa9d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d53cc0b3-3987-5233-a498-61f0fc500840", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:447d200d-59d7-550e-9e2c-427c2304f608", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5de13bda-79cc-5ffc-b3ec-fba6501f0bda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ac764d64-de6f-5422-82b8-a9d8be33bf9f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:952098ac-4468-5fad-9b8b-f6586e0f8845", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4fd7030-046b-5e68-80ad-8c6af630005d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e0ecdaf-9a0c-5530-a0ad-04c4e5a87bcc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a51bc220-3269-5ac2-ac80-6d0fc08fd2d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6a01290-b1b1-5bd2-b684-4375ff185cf1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f165215b-7e67-5c0d-9392-e30d6f4abc35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1730b813-fa12-5e56-b1c6-36fe3ad306a2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f163b757-59aa-544c-8cb2-30d67781adf4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6799959c-21d0-5c36-a9bf-87443891df50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d79b2d60-7966-5c3f-9e7b-0a1a969f11b9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d967cae-7553-5099-a666-c6c153c3daf8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52d1b12a-6b4b-58ee-b34a-451f0c9d92ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0960f5f1-5e57-5b8d-84a2-0d741328b2c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:559c573c-a893-5c27-ad04-3d1b95d336ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a4b3380-e29f-538b-9706-e2ef897d99e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:294c5fc1-faaf-5d77-b407-defb83bef6ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a95fe5b0-ef49-5fd1-9812-f403bfd814b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95f95139-1150-54d6-b638-87c9ae2c20bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jcl." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jcl@5.2.8.RELEASE-tuxcare.2" } ] }