{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c744b8c1-ebbb-5ad8-803a-dfa0414031f8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60193ba5-030b-5c7f-82f3-28acc10c22c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5141d921-ab30-583c-8105-9332a8d5470a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1c7f1c00-b323-550c-b28b-7e2b3600eefb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bd62ac16-bcf9-557d-9788-19cfb88d999a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19dd6c45-60fd-56fb-bb6b-1164aeedd57e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d4f48ddf-ee76-5313-9556-428e0a5bb38c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf7d28d8-b817-5c11-a0cb-d747dfd3e09f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:833dee29-d851-50bb-bc66-5ceb95b58306", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:32153809-2adf-57d2-8ea0-d540fa19306b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6d695976-0ec8-505a-8736-55d76d9d4d7d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5a4b6d8f-b70f-57ce-bbf3-9a4a9511de0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:02cc51be-cee6-546a-be79-738b58d324f6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ceaaa60-928b-54dd-a762-3e046bcfbfed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7d730122-d5bc-521b-abac-122cee62cdc7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ea95f8b-724b-5556-b212-28a76070e6dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6bd289bb-c2b7-513e-8a84-a6ff06d11fb5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0b0851e0-8668-53cd-909e-0a798e6add72", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fe09b1b1-9de4-5c0a-95b7-5b5d746a3f0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ab45802d-4f0b-58f3-926b-10358db9282d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0d23edf2-9e3f-5a21-9368-bd5fc7b6a301", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d02b2a9-2471-58db-949c-af50d5f274f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:41553afc-a5ed-50fd-8637-aef70336d5aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9cca1f7b-b63a-5cc1-8c72-6cfd95dae68f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa030ecf-fd4f-5814-bd4a-831a69268608", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:50829bed-4d10-5200-862b-ffc9f2d19499", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2373591f-c8af-5b84-b5cd-fadc1b0d2cb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:439e7f70-499e-5063-82dc-fab2c6c310e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d88876b8-b0d0-5c44-9508-1408ef0221ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d76e883e-76d1-5eb0-a0a4-93c0954b1305", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3ca436b5-16c7-5195-a73b-47f6effaf90b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1182968-5c33-5809-bb29-5a693be73c37", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0c795c51-dd83-515d-af42-a34ff7e43148", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba1b6c5b-97d4-52a7-bd5d-ed39c68053a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c5a46fda-a71f-5e97-af2a-b90c200d6c1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:31e7df7c-8a12-56e4-9c57-9985db12ee80", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1297a7c1-6817-5176-96ab-66d1a3800245", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a0fd4378-9b61-51af-9872-d62eae07f82b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:62f1a55d-f5de-599d-bc4b-bca571779d5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:891a338c-b1d1-5ed3-bd3b-beba986c4199", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8bbaf1a6-52fe-578a-8fbc-d8cef1b0ba5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3d3de4ac-d82f-5793-b92d-1bdaf0ac42c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9af4213c-c764-5120-85d6-dceecdbc3305", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2dabd5c6-70d5-59e7-921b-5c04939f5ec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1a10ceff-8b14-54c0-8d6a-85ce82cc1f4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:50e64472-3329-5e4a-86e9-d289b10e7bdd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1eced0d-41fe-5b0a-a889-64483bad87c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6554fe3c-6ea7-5290-847e-bcf2cedf3684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d85d53cf-07be-5cf2-a299-939ccea934da", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:848330d5-0068-5aaf-817c-26b7777f2088", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a923ca9-825d-5db8-b5ba-ca7dd18bd21e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:aa2995a2-9570-51c3-b7f5-e993b8a6e193", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d122a43f-db26-5803-bfc9-66a470734020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b88d97f8-1e3c-5e75-9c45-1fe0b86f870a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:90474bb1-6407-554e-bc44-440480513165", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5139ece4-1328-5a8c-a383-45a173cd3437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9deb8ba-6620-5cf9-9448-8639d052fe2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1f56c4e1-3f2a-5a04-9da9-6193987dc766", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95f5c1dd-ef52-5c1a-a952-5637717fc34f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:714a116c-e84e-5d2e-8526-a51f7e18e46d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.10.RELEASE-tuxcare.2" } ] }