{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:17c35e74-65e5-580d-83ba-d37c66f08cb0", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-web", "purl": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:35038b69-0af1-5964-bfcc-ec0c2fae85dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:800a1f3e-515a-50b4-bbed-9d38a8434f32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:91a64fcb-109f-5cc9-bb24-33746a05b87c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86c16b20-3021-589f-afc7-c4e61d0a5d69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:76cd04f8-8bdf-5601-8d37-c9ddef45c8af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:60839757-3ade-5006-9d6b-7a11c3e47a14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2793854e-6ba2-5cfc-9651-2e5bcd13d81b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de2cec1d-bb43-5e10-be92-d022c1939c88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c733f1f2-8ca4-5d42-baba-e7cb47050ec7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b74e89bc-c85f-5294-bbbd-dd2536543fd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ceaafe0-7188-51d8-b6cd-099a4fd831fc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:63fcbe7a-1314-5f1f-8f2b-9d24ebc52fa0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fa48c65f-ce7a-5d86-9f46-71c0f7ace198", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2fa55a3b-af1d-5782-b32e-2980b7847c11", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:04055e07-d7d2-5771-a6e9-1f88f2c1cbfa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d0d16b2-2f48-5b72-a2ac-adfd0fcea85d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:640f2cd6-535a-51c5-8279-2c8a94d822ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d1ab2fa-5be9-5f04-9345-54e881bb6ddb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:850cd956-d30a-523b-94b0-4369ea4d2555", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:af12d848-f039-5ca1-bd62-3c017eb8c0fc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:db3f0566-074f-5626-ae8d-99dd7212dab2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2d302a3b-a5f5-5fdf-a2b8-aebc0a7154ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b610dfd6-faf4-50cf-bf9a-6c674a19807e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:39da5a10-8629-5b96-8cea-cf0832edada3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:53ca81a1-e7e0-5666-ace6-18c8b3ed83d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c8242f52-e1ec-56f4-8ff2-aa8708200a97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f07e3a22-1c55-52bd-b3b1-f26fe776c816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8fa34fa3-0c81-5821-8f6e-985869b76276", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b977f9d-2115-59eb-a076-fca6d21b4a52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:92fe32d8-1901-5f35-9953-effcf5153cdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e65aace5-648b-5039-b93b-84cf17ca208a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b114b184-ee78-5dce-82a1-b638b6116ed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b73f2f1e-6f25-5e01-a828-76ebe14ea97b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:386987fd-4367-5968-a4b7-a4b1f22726b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:960afb03-dae1-53d7-a121-21d4c860cf2b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4bdf3337-048d-5957-b1c3-3b38fcf22a52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4181915c-cceb-5fd5-9ec2-5d3693371c92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:396f0983-3ace-5318-a8a7-4d8e8d8e772d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd2e1cdb-b867-5601-9cea-c190fd1de53c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bf201b10-234d-592e-851f-f213873881a0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d3e6b224-6337-5cb7-a464-bd05aa97d1cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:44165fa5-e8ee-501f-a8a2-a02c2bc35ca1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4051c47-5428-5924-bf41-c49662efcb68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4623bfe1-b9c8-5688-8c08-9d700c0beb1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b43201fc-ea34-5f46-a7ed-6eed4808fc46", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6a22a6c6-f9d6-57ef-a021-9cb3fc983176", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86431f95-5734-59a5-b836-7ec5598f2559", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dde71d0b-25f1-51ca-8f6e-e340336bab3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea9770ec-861e-530b-8b36-2e8d23f273c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cdd49f3e-9b4e-5ada-b80b-4ddccd8c21a3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06f70fa7-8058-5aa7-94e6-83357cfd271c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18cb1481-fdb9-53aa-828e-3b4881164856", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b216cca-c16b-5bec-aef9-9259d497df5b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:559ec680-dbb1-5529-a9f7-174b37d9788a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b54ee1db-349a-57fa-a771-e642a7a1e24d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d981caa-4be2-5c71-9e64-ec060a189bda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2765578b-5344-51ed-81e0-1e2b53f897be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d93bf57-5604-5d0e-bee7-ba09498a6887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74bf4f00-39f1-5e25-9d1f-b62a5b699f30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7b71abe0-f890-5aab-bf60-603779722015", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1da82fd-19f6-597d-a389-88f067abc234", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4f85dab2-9ddf-570a-ba49-237c4efb3714", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-web." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-web@5.2.8.RELEASE-tuxcare.2" } ] }