{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:87f93861-65ae-5a88-9157-56f614b294ce", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-test", "purl": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a39c166-c784-50d6-810a-19eebb95214a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:15bd272f-6ba4-5616-b30b-e41221d3b666", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbf2b6bb-c0d5-5d06-af14-fd56501a8b77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5edec7bd-655d-5f98-a2d5-5491fdde97f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c47348f-29fa-5fc2-92e4-3f3251a3d162", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b892206-ea9c-526a-acde-c73ba49902a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c4412274-0c90-538f-b52d-6e9fc0016cf3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:be5302be-3c87-5876-af00-92049b9ef9fd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4baa87a1-db36-52c9-bb87-617317f3907b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f815abf4-9e17-5ed8-b30a-748aae0e121c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d0a8161a-57de-5a9b-a7ce-6de5e8d42a73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6355b71-563f-53e3-a2ea-da9b682a93f9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d6b9791-3147-5890-8def-a4202771c2c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:85292100-d3a3-5208-adcf-f4604c062cc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4cc77f69-4407-5ab6-94df-ef2584473da0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:800bfa67-af9a-5fd1-8b6c-ba60c13c739d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:83fe2de9-7967-5216-833a-5ed7a23ffe8f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:96eec906-9059-563d-8024-9c1a4b300359", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eda86a37-4208-523e-aa27-46f12d68c7da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0e3ee222-534f-5cd5-b4c9-f19d2d0769b2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:77349b10-a58a-5970-af20-1dd04e664d23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:510602fd-34cb-555d-8940-b4a6baa48657", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b87710a8-5fa6-59bc-b327-ed3ce6df46b3", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c758101-6e24-5eec-8794-63ae76fd99c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f661bfcb-9cbe-5201-90fe-52ef5bab15a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a21a100c-6982-5511-982a-48a323f429b1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8b57648-bd16-5c96-9640-11f0adc7a5b8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6484cad-1f81-56a1-bc59-ba8b2317dda6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7c5818df-1ef5-5c56-82ed-6f33e127f2a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9763ff7d-2193-5e15-b930-a50269611169", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb76d1f2-a9c1-5270-87d5-877449e50b6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab431c8f-697d-5748-ab54-4b224c674b29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:17e83d04-0254-5301-81cb-15faf6322aa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:15b997a0-b607-590e-b04e-22da4abcb7e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e3c66401-1280-553e-a926-ef1da2952f15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e0d390ca-392f-5942-82ab-291cecc2edb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:880aa2c2-7687-5dc6-90b0-9f98aef2d1c6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a6ba88f3-d886-5436-aaed-9af2d5251908", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:03e98d73-0fb7-5106-a317-32e33a5e5275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de7f239e-0b79-56ba-a59c-651468c1c976", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bed30728-1cc0-5584-aa62-44a2e9174854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f8eff0ef-3f0f-5381-be46-6732599e8c91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:220eb8d1-84b0-55bd-a905-bc392aee3c0d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b831cc9-42ec-5cd0-bf62-ff49086cc5a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:543f0dc5-cf9b-5ebe-956b-eb96bc83258d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:530390e2-0a4f-5daa-a632-86c1c8bcefe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9b72dad2-5aee-5392-bc41-2648990f59f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bb30d000-3508-5a24-a486-591f240f9dfe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f3b34bbf-4060-5ebf-a5ad-d9ae06bc6fc7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:54f2b911-1261-5ef9-bb73-9f7a21048b89", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2846cd7c-2007-5e68-b0e2-9f729e903ce5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f0a4a328-ec22-551c-ad61-874871aacf07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:846f4a81-44b6-5b4f-973a-dd7965d4db08", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ef146da-9487-5f88-a063-b53f261937cf", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:438c5514-c19d-5acf-b231-f6d4d62fa81a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f5832f68-ea6d-5a58-a0bd-944c80ac100a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5c34920f-4b55-5729-94fa-185e80bd5482", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c6840a84-ad27-5f0a-8d21-e78850f3a36b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:566b50a7-79f5-551f-acf1-83ba4a8ca1ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ebe9096-a401-5ff2-9b03-c05a07e4ab30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:632af06f-8089-5750-b0b8-630ec96f4b3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fa7013f-d128-5e47-ad6b-3764acd7da9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-test." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-test@5.2.8.RELEASE-tuxcare.2" } ] }