{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:d576e272-5db1-5aa8-8315-4a4d5b0ea487", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:093b9b3a-1d41-532d-946e-dafe11098958", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cb6358cf-4ee4-50f6-997c-112ce113a1f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:209a0c56-8358-5d2d-95ac-3362dfb6266d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c37108bb-eec5-50c0-95f0-0492e3c28229", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea942de0-6eec-5616-a05c-bc890e14dd16", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad914323-3e1c-50f1-a525-540a6ed4614e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b058f739-e0a2-570c-ab05-e9262d8f526a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:44a4babf-d8fa-5619-99c1-acce076152b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fb978fc9-7714-5095-bfc0-fd333d6b9a7b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fe7f2610-a084-59bb-bb74-65e94dd14281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c980dce8-b5a3-533c-a764-365c04ea2e2b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff1e7a35-1be0-5260-8013-3a7fb7153799", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:255418db-201f-5e84-a607-42d96a908d86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c55f66d5-6dea-549d-b453-34bef59f87a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b13f252-2402-5589-97ae-6157a16cd955", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d74e264e-d64e-5529-9378-dd5bc2d86d7d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4af43b14-d6e2-5c7c-a80c-cbee53934387", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8f85d362-bb9c-54b4-ba22-0898b9abd029", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ad0e9d4-da36-5c39-8c3a-efd356babda0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba3b45bf-a3a1-584f-8370-e59434b14fe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:070f6321-7756-5a57-b9f5-4e92c732148f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:02d5df7d-1b27-5d42-b6d4-e10de600f309", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1acd987a-19a3-5148-9871-9f34df1dcfae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60c3464c-b9bb-5173-af4b-cb216e5732ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1abcf76-bf3e-5e37-90ff-f5014a974809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:047ba7b6-f37e-5199-93de-991894b1484e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5a9bd8af-337a-5b12-9b62-47770948ab36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c13faf5-c2fc-5c6a-b5c3-88f5454ca561", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d2e603d-3083-563f-961a-27e423f3838f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d2c48bd-790f-5677-9673-c9e96269a0d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97378a20-3801-529c-8f19-113f765fe6a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:87e0acd5-f01d-5436-a445-310625965996", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f2a8d3bd-805f-5fb8-9649-f3e192995c0b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9769aa2c-f918-5337-952b-b0a15fa466c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:90ea0014-d5a6-50ab-b718-e58dfb398a39", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:329455f0-9b0d-591a-99ee-f23dcb88ff67", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:22f66135-68d5-5c33-b277-7d767f77143f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a7c340d0-551c-5027-9b32-422daab2e44b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b5af553-32f6-53cb-bdfd-bd425f517e9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4421fae1-86e7-5536-a7d9-ed89deddee70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:987926bc-b2e2-5cc9-bc5e-dd8878cbd1f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1bc486d-db23-516b-afc2-799c4346414b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb046e12-881f-564f-87e6-9fd7580f1db1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a445b14a-7879-5cb2-9fac-42e6ad2342d8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f04c467-85ee-5fbe-8cfb-3f839a51bd86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb2ef949-6e23-52b5-9c13-14ce59fc268c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91601d69-7165-5a38-9d8d-25357682a28f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a485fc9d-7b28-57b3-b434-fcb6cfecf1bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5f19a30c-3d2d-5e77-a161-090ae1a413bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:812f367b-371a-5af3-b6f7-8d26e2b137a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c8a48de-4e9a-552e-bb6f-cbc2adad710a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:34fa0948-3359-5739-8b48-9faaf12897e5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bca26881-434e-5414-87ca-15125aa5de9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0c68aa2-1cd9-5856-88d9-71540c42ee1a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e44fc329-2e12-583a-b4df-9306eaae82a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d5b0fc25-23f5-5155-9c8c-321acb0c3718", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1f48189-ec96-5346-a0fe-66032daa5f25", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7647143-3e19-5246-be1a-7335718ba94f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9834fa56-2ad6-564f-961c-c6cdebd26b84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.10.RELEASE-tuxcare.2" } ] }