{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:df2cbea4-e24c-5534-af67-c47b86277032", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-tx", "purl": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6563b54f-fccb-5f63-908f-43aa1ed87307", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:65b76d59-cf8e-5c0b-b43e-dce207ea50cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eed2db63-eac9-52a5-807e-d50a72645cc0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10cb2b99-e3ae-5916-a085-b69bae9d77d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:229aa780-d267-519b-b50d-1494ea69115d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d80dc5f-fd66-54e1-bb24-a53c17b0ea8d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:35792645-1270-5acc-bfee-ee130d93d84a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:786227e8-451c-5254-b6f1-aa7d6a59daa8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:36162029-9749-501d-b0ab-bce03fb21eed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ed56413-9f1d-552b-b855-c9d438cace8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:75052d6f-6eef-5e43-a193-714de834c982", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:151cacfa-80a1-556b-ba4e-8e89a53e7547", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ad9a7732-0e79-5f8a-b443-629debfd81c7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d76a89c-a995-5539-9e15-7ce9b37d4365", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a5bb59d-69c2-5289-95f7-986915bb3fe5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd960c8d-b606-5e69-8708-523298a023a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d9dbdd5-d292-5983-a837-a01e69914220", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5273dadf-dcd8-57c1-927f-7c0ce94ddf5a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:848a7f88-ba1f-53fa-b383-74333358f95b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:726024a2-bebb-5612-a3ac-a6127bb66891", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ca68e124-8819-5297-8d37-af11b3404bc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd88b2ec-c6e3-5ec7-b311-c7f16e63d234", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56ed4548-ae5a-5c7b-87d1-f985ec9fba31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f529be93-90b9-5520-aefa-163d8b14dd6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:055ac5d4-58a0-5c90-8d97-4bf81bdeeb9a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f02a1f3e-211e-54f9-9cd2-0d001d84c0b9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b377acd-420e-5224-b1af-8c6bdbd82c35", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62cf0816-7ff6-5dc8-8afd-f948f200b4a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:38355550-682e-50c5-b3c4-ca3f9fd1ef49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:88672a80-4c6f-5956-957c-ab2c46e7efe7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:978ae007-9c78-529f-803d-117c905c9c84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:479720b8-336a-5515-9606-d30388a6869b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8360e542-e1c6-554b-928d-ac901c40a410", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce645448-f8bd-503e-9b46-66b73740b9bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d894b1f1-96a2-56fe-b302-36bec7c0bf87", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:122a4746-5b0f-5fa0-ac53-8411ffb29af2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3e58899e-d663-5034-9e46-2719c650c2b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28603d78-e050-5c43-bb91-697d2f1ccc02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:02d0bbd7-3dae-54d9-ae08-6b60598c4f85", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39e6c52a-212d-59bf-80bf-7e9fb106b438", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:721a2f25-f573-5289-aaba-eb352a674324", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1a323441-ff9b-5ef9-95e4-f4701abf7db2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:719cd9ba-7dc3-57a5-8256-9bbc6f64c435", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:35e028ab-27d8-5619-8d9c-1ac527dbe2b2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b523463f-5cf1-5ec3-add6-d14c87d998c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e0de2c40-a031-5030-afb8-216d7b51190d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e90a30fe-3c80-51ce-95a5-4df2aa9e8262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b8197df3-d9fd-5bd9-a14b-ffe8c82d1318", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f5e7cdd0-c2e4-564b-9246-dd5858619851", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9db59572-2213-5174-8376-a71a6d215aff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:66193a2e-3a51-5115-b84e-4646e49d5505", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1290bea2-3f18-5108-a913-0d65b6b4afea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d28984b2-9c76-5950-a723-63f652fefd4f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c3d35d0c-b830-56c6-b456-53938494c003", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9c9b702-ed8d-5667-acc0-7265231cf055", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1201f87-bebd-5a9b-9acd-3d79329b3275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d07dbf60-614b-5f17-91b8-0a24b552fc7c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c25b0426-1307-535a-9652-20106f975857", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97515cee-347a-5f5d-be3c-ea1a79635c2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dd88d3b6-ca45-5a9b-a2c4-1958c8343306", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a141c5b5-4c84-537f-b674-f5be5dd11ab5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb8ba609-53c6-552e-9b84-a6df541a719e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-tx." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-tx@5.2.8.RELEASE-tuxcare.2" } ] }