{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5da7772a-ce33-5ad5-9b0f-0b0d0bcba6cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-messaging", "purl": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7460c512-3629-5ebf-8792-31cd9bd3472a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d94a1664-768c-5222-b3a8-fd66cc9dca66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:68d8004f-2729-58df-b928-db22a55aa870", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba725d21-f904-592c-bd12-cab29e380368", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b515d82-61ee-56c9-8013-1aa10c635ff6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:079803e0-d645-5be4-93ef-6f7292108058", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da4aaf29-6ec4-5ef6-8faa-e8232edf4f53", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81587d2b-3190-530e-8a36-518b2ddf964c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:110a3c80-4065-54ae-8fd2-6bab1477e664", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03af65d1-e47e-55d3-a35e-9a9f72886188", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d2d13eb7-f196-5381-a8e0-0a1fbceb9c66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ecb61c6-abd9-5b61-8a57-fc92ed3339e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f97ba7a-ba96-5b59-8bb1-9e7195b9efad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2cb6756f-2a74-5daf-b553-5ef3399ad60f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:46cab846-b04c-583d-beeb-94c4893094c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3240df8-c816-523a-8b6e-2b3a33706daf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:31d13868-3e75-5084-8755-38ced34110b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0b95f015-6669-53d9-8c68-01e22634bcdf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:44f6af0b-544f-5d7a-9feb-de4a38951279", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62eef6c6-74d7-57f2-87a5-4ef1bd8bae71", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b40eb8ce-fa7c-5d62-a33b-edd129328da0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8cf07360-28ab-536e-bd97-8a7f59e749fa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf42d770-eb7b-5f94-ae73-5498f3c88ad3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:20581004-4e5b-5ede-bed6-6ac2ffe8d938", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:145ff036-2b1f-5b39-aabc-67bc7e00c177", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18b2328c-8ddc-594e-a817-510035922890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a56b3c9a-2432-54f6-a43c-60f81eaec133", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa343fe2-8755-5949-a6a4-3e4859e4cdf7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:df17ef9e-9600-55f6-a120-8a4d37843ef5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b2c8771b-8932-558e-83b3-0697a82ca1c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bdb615e5-3eb9-5a4c-b0f0-3ba43bce9c86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6f0e1a0-1365-5cb1-a793-e327554d36b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:118e6f54-90e6-5e0b-bad4-c4d1d772d5c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b824ee57-555e-554c-94da-983d80496d00", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6dc375ad-b11d-5754-a4ab-127970fefffa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d15896c-e11f-5636-af81-2b2d0eada13f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d5c46c21-31b1-555c-aadd-e399ec6168e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80b5775d-8fda-50b9-8234-dadd3a694691", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18ec7389-1c86-58ff-9e1a-4736972c0a7b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:57c4a7f0-fd63-5b08-857e-509922754aa3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f0dd910-43b1-5747-89d7-fc02eb645419", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52b5fb7d-839f-5b5b-802a-59b1d44a6bd3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d982b58-b649-592b-8963-ec0abbee8457", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dda94fb4-e610-575e-a9cf-4fca8079962a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae787cf6-2740-50d5-85ea-6b7643aac573", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da8e4f14-0b97-5225-abc3-764672a7e681", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa735cb8-7847-5111-9c91-1e8f5bb456ee", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9bf6145-026d-526c-8f48-4fa7dc8b7a93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae6cda56-76db-523f-b11b-4a67ec82ae80", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b6b6c6c5-d518-5060-9d09-dffa9929490d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f87c9bb1-adf6-5021-bfed-1c8bd12dfde2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea1ad3bd-97d3-571b-9559-8ad379a68d4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03fa059a-3d3d-534a-8e2c-4e021c27cb7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ee28a2d6-586d-579b-b10d-ffc8e37b6b5c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c079ea1d-f26e-5c0d-9f7f-b28e5a1a5299", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:29bd0543-b82c-5391-8479-502ba0215823", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:81cc86ca-9769-56c1-964c-7b7d88122c91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f41e12b-225d-575f-b082-e5f331e8638a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6bd228e2-b536-528b-84df-97b55e9f616c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:24c48b5c-568f-558c-b41c-0e1840a8fdd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:657ee75c-b5f4-5340-bf7b-e8fe71e9599c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b604877-7636-5ee1-b044-73e56787608d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-messaging." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-messaging@5.2.8.RELEASE-tuxcare.2" } ] }