{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ca20e15e-e8f6-5d26-9e3e-1f87531f102d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-oxm", "purl": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cef107e9-e6b8-5c3c-8ff8-08b5fdbf5c03", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:305b4845-d04f-5b71-a37f-c4b74fb84a6e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f154f3fc-a89d-59f3-b3e1-353fd430c312", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a2ea06c-bb5b-5354-ab1d-15eced8aa6f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:238c1fac-b56e-5bbd-8ea8-81dc1c169afc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1520ae8f-68a9-58cb-96ba-4f69cfc3edc5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b7c78633-162d-55d5-a7d2-ca86e09474ba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27db6e79-851e-5050-a5bc-5645ee8dc134", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7e71da9d-8775-5bce-9ec0-ed00c59b1d7a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e6e920d-d4f6-534c-8e98-d7494dd303d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d66a5c8-9a4a-5a50-9e28-2137d1edd33b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:534677f3-9cee-504c-ba47-90b0dcd42bdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d75def6-df3c-57dc-96f2-b2db43a4c4cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd723aae-d363-55a8-8e32-b95771040d59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e83226f-0e47-53b0-8f37-e9fd89bc1c6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5177859-e348-532b-95cb-34b38a4adc55", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a31e5c7-8598-5de2-941e-f5e7eb7945e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc4641a8-9abb-5261-8b06-d4c24a440806", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b29de6d2-6d45-5aa3-ab5e-49af4faf192e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b8494da-cb67-5018-bcae-de16336b29b6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:55772148-d461-5292-9c1d-cf024e2b5eca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4114dccb-8e06-5234-ba9f-8213f4f496c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e484332-4d3d-5ab3-aee5-bf3272c13d55", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ca51f3f-9d7a-55f5-8e34-e66a78e060ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62185428-6a85-5cdc-985b-b32a9964083b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c4a017a1-88eb-5ccd-8af3-107aa6e78423", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:49df88f0-c5ac-5322-93bd-08d742684fb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb0a78ef-0d29-55d8-98f0-8f5c7dfe4a7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:034d1b61-3776-54c9-8922-76c8dbbf675e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa122feb-4b71-5bbf-a975-fb869b8e55fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7badbb24-02de-54c1-942b-6ee832348cef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc87b527-00d2-5467-a3d3-aee24f757e18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ace9bf40-4d26-599b-9a34-0f61cfd14e41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b5e306e5-e84d-5c09-b947-80dc531f1d0a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab86b8d2-43c3-5a5b-a5a4-3cad076f4bd5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dea4df2e-c4cf-5d7c-8f50-014ae0273111", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e2bc63d-8a9a-5aad-bd18-096f7984be98", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b2a11466-5f1c-5f3e-8ab2-8a4422ba982b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a83618d1-1b68-5a89-ba99-31be352bfcf5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff0dddb8-831d-592b-b1b3-3cf1e7234f5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5bcf2133-b925-5253-8835-6805b70f0a93", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7e11c48-2555-5344-a2c4-fea28267cdc3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ec30f0c-e613-569c-abbb-ffa950976959", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ec5a6c21-8494-5a7c-8ef6-cbfe17f48ffa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8da49a97-c278-5326-9e50-b68b5a7730af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c5cad10-d019-5f41-b854-263e2c3dd39e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff1d5e63-e98b-5b5f-b1e8-23effd170771", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8af059cf-3fd7-50ae-80dd-968538135c19", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f445d503-3113-5804-8c09-c24adc312212", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:12207bd4-4266-5494-9902-1e61a8ec4d63", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f95a0a3d-eacd-56d1-a243-415a00aaaa17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3f9e3fb-1e78-55de-b09e-491a68124a71", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e9ec83f3-2c0f-58f8-b880-80ebdbbb05a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06107c95-be07-5585-a9c3-c5f5d65ab743", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae1ef3e7-0cb8-5789-a390-28b7377c976d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:943d13f0-3f5d-578d-ab2d-19d03d7fd982", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4273fb1-6ed2-5c48-967d-4f73846b3c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:249dd215-df41-5afb-be2e-2d5217f35ade", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:432e8c3d-b604-5e89-b66c-fd4799dab7e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:549fea14-bcca-5ff9-a467-c248c2e7c1c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7745fb80-8382-5131-92b8-3dde4de26824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cb1434d4-9ae1-5347-b83d-70173d1d7209", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-oxm." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-oxm@5.2.8.RELEASE-tuxcare.2" } ] }