{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af691f36-1675-5394-b701-6fab5e1b1f6a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b94fd29f-b8f5-5ee3-a136-fa7b26dcb136", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3f82628-9bef-56cc-9219-14fc8a83a549", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c8bea94f-41f0-5c3a-a9a0-1f2863e3d6b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:148cba6a-68aa-58d3-82dc-2abba04f18d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:667d579c-ce5c-5001-9a33-4bc11960fb50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f906afe-8b9f-5565-9731-1459a7bf91de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a612b4d3-bdee-505a-8e92-897ce72e89e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c976785c-666c-5267-825c-dbdda4943c1e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:07facad6-22b2-5d95-9e15-3a49751a613e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22b5a5fc-d0bf-5d97-b2f8-445c1a41019b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be894420-3caf-5469-9e58-93d7df9b2900", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:70ddbf45-c1d4-5060-9cd0-1ac681cb329b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a17c2104-1633-529f-a8b4-922af63805e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c9d60b64-47d0-50ca-8e3f-7eea85073ca8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca0448e0-ea52-5650-b26d-3d284efa3622", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:11e9f9c6-ea13-589d-a267-f4d654dabb42", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:886f2321-a2e7-57f7-ba08-29b518799104", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3fdaf46-55c9-5a36-ad31-1dcfd86297bb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:33b87c1f-7e40-560d-b735-cbc0bce48833", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:26eb9ba2-28ab-5704-b264-da5fa8082726", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:67f83e3e-fa67-5a5a-b581-8b2871277837", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:82c7de38-4ab3-53f2-99cb-535b4c673690", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1cb11104-7324-522f-bb69-3eeac1029e6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:71d984d9-7a61-59da-bcff-efa5a8ddc346", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22c522c5-6802-52b9-b040-2012bff9743c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:949f36f8-1f48-5f3b-8351-4c9e28532a1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5304ca24-6aef-5304-a9a4-285d79400773", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:747be30c-af3e-5a62-80b2-32c4efccbf66", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a28ebc29-0477-5167-a7c9-17b9eb317e25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e5afddb-d94f-5826-ad3f-3d11e4480f25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:302638a5-af83-5315-879d-18668b06236e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea2c3091-a62b-5c4b-9e2d-99b82c9989db", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:00cf7c4d-554f-5b29-bcb2-3563400f7cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19c7d953-812a-519b-8fb6-22ac6f23e73f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4b6ce9ba-a660-55ce-b29b-23651c379abb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6218e8b2-24b0-54ad-ad6f-494b35038940", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bdc70760-1f6c-5b55-aeec-be8a1c9e6381", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f431c79e-1d4e-5e6b-a028-928fab0dab49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a82a7aa9-be48-543c-a1fd-7fb07e1bfd16", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0983993-854d-5fd8-87c8-f32d07085111", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a61afa5c-c6c1-5a40-968a-02bfbdc9fc3b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b956b5c-bb65-58e3-95cb-9817bdfd372f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a630f4a3-0553-5d9a-baf5-c24a381282fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c959e8e5-b21c-526b-bfc8-16f0b0e604bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b4ea1d3-7426-564a-9e38-25e266cd0762", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b8b65564-88c2-5130-a240-6af256e35f09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:17537fe6-761a-5254-99c7-fca49ee24b0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52340a70-9e11-58bb-96ba-fd4b35a895cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:afcdbe88-9cde-5fe5-b4e5-4d8b37eb509d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:443758ac-a934-5930-8ac8-76d5f50f7b85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:23707372-6378-5504-92ec-d17ace6af227", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d8038402-9ca6-51b7-917f-3b091f3d206f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b7505f93-8a7a-553c-bb1a-12d879cd88c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60a3edc4-2d1c-538b-bb29-3a01cc8e4fe0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1e647889-817e-503b-ba6b-cb9dcc028852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c89ec51-9d5c-518d-8655-5ddf6c025f37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d5c8272-d6f5-5214-9695-21c0bfbad882", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:664aabdf-1040-5812-86cc-5f42cab3350c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:feee8a00-9dc5-5871-90dd-2a601dc5bc03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.10.RELEASE-tuxcare.2" } ] }