{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5d4f3f91-1c4e-5678-8a5b-c77de15a0d60", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-orm", "purl": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:61a30411-cfb4-5164-8374-523169993114", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d5072de-80a6-59df-8527-246711bda2f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:351d7a3e-81a3-5493-a1c3-8e0602281b85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f6e13980-a410-5bc3-9bc2-85ab726a0eb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:160c77d3-c4d3-5859-b061-c114cc596201", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:582d8eb8-36dc-5519-866d-95b9569cdabc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a14dd4f2-f675-565e-b2ef-9415a34a46ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ce1df6f-b65c-5c01-a5c6-9fe91136f33f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c0c85f9-e93b-585b-9673-2c0bcd2b088f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce4f67f9-cd75-517e-8d61-9db56318f6f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1621b39c-5511-520b-89a5-ff3999839f31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:84e7fc4c-044b-57af-8ec8-65e0621493cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4cb76434-70ad-5d5a-9952-eb549b343225", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87c1546d-bfc9-5b0a-b119-c1ceb55fb939", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bcf40789-20c5-5940-8e54-31772a359e65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:48749e57-75e7-596f-bcb3-18ce20bb2d9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6e2bb490-0ed9-5347-9650-00edcebe9c2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f61c98c-9ac3-5de2-8bf2-d6b34b4d00e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c61f1774-6243-5b32-a1d1-3a28e196ea4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf1d673c-36df-5cb1-8420-511fd55f0bfa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c96e0cd6-e517-547f-bcc8-5e614f47dc7e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28dde28e-e8ff-56bd-bf3e-94decad82365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ce14e43-89da-5d5e-87df-fd6fe17d10ec", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ec6c8532-4230-5b43-8054-2cf4e4b29790", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d094faae-c058-5fed-b8d2-3c1ebd0cefd6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:899ce169-0fe7-5931-a788-0888bb4d1bab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:698a9d10-5e3b-55b1-b60a-c41a0b58edf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae6323bf-bbfc-5ed5-b542-ceff7c92730f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9b6e6f86-c12e-577f-b426-1a56053430d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f91bfff4-453d-5f1b-baa9-1f6e3cbd9f40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c4594d9b-d2ab-528f-a3d8-c973b21e58c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ddeafc9-6f25-5ba3-ad42-6148c26a12f1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d376d3c8-cafe-5f7d-a444-5965533b316a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e19a658f-b318-51db-8998-9fa058196082", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3cb1442b-ae52-5615-9370-ae22f8e5f6da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a46a2bcf-f81c-5c79-a886-7ebbad88289f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3a536ae-f8c1-5185-8ae1-2e700e7b7993", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3fedcd1f-2dca-5eb7-994c-7b5283ce9471", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c022cf08-ab13-56fa-9e9f-0ebda409540e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c3a907d-e6fc-58e7-b761-c74fa7be9f28", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f915b45c-7f32-5e21-938d-1ed3cee43523", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3efe47da-0faf-5b49-9046-c39d75671ad9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4d27e42-95d3-5cd9-bbf7-76fbc5dc8edb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5a66db87-c392-5544-a78a-35bffdba1910", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:71caede2-1052-5cc5-93e7-70efe9d885e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:da884856-daaf-5f43-b92e-9998e18f76ce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be694e11-882e-531e-821c-86dc94e6b332", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0c001fa3-b418-5dd1-b1db-91da7091e1cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:80493c01-12d0-5fb5-a3a0-1cdba349fc3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:410c8921-6aaa-5a98-94b3-595840d11cb2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:921e1fdf-79ad-5bfb-955f-a6396bc34cea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55fe983c-4f8d-5917-a94e-08ecd286f432", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb37f830-a261-54bd-af0e-64e17f8d0d25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f4348d9-bb5d-5caa-9dd8-baaeb12ccc1b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cb18a91e-94a8-5cd2-ae0f-ab078a81dd19", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0e38de07-bbe0-5a7f-bbed-f2d33c101c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:13887156-615a-55f3-a641-65a8bd8820e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1977b84b-a86c-5d9f-ad28-62a1b3790a85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c515722-cd45-53ac-a1e1-f199345505ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb768371-7062-585e-ad95-a7db628650a9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3bf7a1c4-6fbb-5d30-933b-8dd868d7986f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18da3418-8b02-5b3a-aa97-896dca505a93", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-orm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-orm@5.2.8.RELEASE-tuxcare.2" } ] }