{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c1a31656-9628-5086-afa4-06d9cd457745", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-jdbc", "purl": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3ac5c6f-164d-52ed-bb97-5f6ee70e9583", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:500909a3-4987-5299-9b05-a0654b9935f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e8f6f44d-e3b3-5574-af2a-a2dd9b13cc00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d1df691-8c0d-529d-9a45-da03cc21709a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c680e995-14ec-5a1a-9f0e-2b6cfaff9514", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbdb945d-1465-5b38-a6bc-3c9c4cced88b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b161cf4b-66c3-5cd0-975b-8e8ff3cb588b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ea51e56-751b-5e05-a867-d4ee6039313c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:30be9769-3e11-571c-a22d-447407e5048a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7a16233-adf5-50e8-83be-77010162c8e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b5dc9814-c8d1-5cb8-9d3c-0d33049f5351", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a7c0389c-d3d3-52d4-842a-33849be5ec26", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5bb01086-037d-5d07-af90-ccbdb5538282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a44595a7-a72c-5c30-a726-2b44fe207ead", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3c11f0e-5740-5fc5-b44e-522e7488f634", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:11152bb0-6d1e-523a-b3bf-641ba5c939b5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7c3a439-6e03-533c-a599-98d5d1284caf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ca419c1-ca1a-5652-8186-a9ead51ceb59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:836ec022-2f19-5038-87cb-2e97ffa50fee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4fe50c93-2823-5d62-9402-ba527f53246c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f4f6505f-1b2f-5724-ac0b-8bd036bbdc12", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f06171fe-2934-56d4-8a71-cecc90c4aa86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40e65556-68af-5211-b62d-adf308e8764b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca29e9fd-a072-567f-b9d4-61d988620e90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97e11b43-5c4c-599e-92bf-f610cb0bae83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8bec7b38-4a22-5409-b6cc-ac9ddfe0311d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8ea37cc2-2e5f-5430-8027-8c288c5fe9b6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97ff2af4-4e5a-5e49-94eb-217265ca6e8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa9e0a6f-8018-5c52-a253-32616d187a20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb77320b-5147-518c-be44-630498300438", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:faf3ef62-eada-5409-8090-37997deeacbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10229813-879f-5fd2-9c76-99bf05c76ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b936eed5-a5fd-57e1-9a00-49a74ca9ff5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e50496ee-f9c2-5fb5-92ee-a5ffb69e945a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:34835a78-8e4b-556f-8ff5-79acc45dcfce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e549ab41-f007-56a9-aa6f-071df5f75fd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:59ea8737-1ce2-599f-b81b-5f048651a0f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b408b6bd-75e9-54b5-b3d9-d9181a5d5b29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:40e238c4-6210-5f60-bccd-3fb49c165e43", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b9f96d36-7493-5640-981a-fe69e7704d40", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:821e6ff3-7c4b-553b-a6ff-f849f5597d4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27f37678-6901-575a-89ea-3a14dbec6aca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2d3f707b-6945-549b-b4a7-63b0db482dbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:430cdbe8-ac29-577f-8b53-efb5e8e1ec16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f622a54-2774-5ac3-a3d4-d307bcdfea4b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:568a8def-049a-50a7-92c2-8b3b96bc0252", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:20d8ed22-efb4-54e1-8482-42dca049c129", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72027970-418c-5de3-9887-26684fad54cf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a7ddd5ad-119d-54ab-9301-1588c9ee34c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d3bbb07-f474-5083-83da-292117309b81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3cc43937-c8ac-5f00-bf16-b09a64238823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0c889462-cac9-5620-83a8-ad9080c3c479", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:64215c9f-aa19-5805-9cdc-7e5f8b5d95fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39a43390-99f7-507a-9b55-ff977b9f3ef0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3be32ce-b242-528d-ba0c-88316bd4701b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9fc8289-8bd7-55a9-bbef-96e8380fa09e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7bec2298-f449-525b-bf3d-ee1f76537584", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1611b830-406d-53c6-a64f-2a2a4c854a30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da19f811-3e70-5df8-b045-dec6d2806024", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18d5fa41-51c8-56db-ba48-0c26793c7238", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de7c84a9-cb9c-572e-9a04-f98e72cba821", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8466d52-3114-545b-9c78-bbc09367a23d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-jdbc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-jdbc@5.2.8.RELEASE-tuxcare.2" } ] }