{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0ae3ac9b-ecdb-588e-883a-39e6a0465d5e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-webmvc", "purl": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f3108ca-f66c-5306-999d-5ab0d181d0a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ae6d0f3c-4213-5a87-92d6-6ae42b16905b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:de25fd43-eae2-57b9-a4fc-b142cf21ee66", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:21f57da6-b6ca-56dc-a31f-ddb7c16d3110", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f98f8a9-5aba-534a-b288-5761ad33dc44", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0ca2a7a4-3665-5293-a949-c33f6d659136", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b69e4c12-e81b-5a60-9692-4f67ec14bc1d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2e02b208-d6ff-5563-8446-6a1f77490a30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4461b32-b4d1-5f5f-94ed-addbba4fbcfb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e031334e-52bb-5d58-bc7f-ced93d6d866a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6bfc81b6-b042-5b51-a948-aeca4ef2a7c4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a31f5a7a-7821-5dc9-a822-75d9417e811b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:06c27b48-5d4b-5054-8f11-495aebac7495", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e4edf82b-6440-54ad-b714-e6cd79260aad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ee09bde9-35d1-503f-bc2b-2c094aac6ba3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:13889d0c-69fa-5b8c-9a05-9112df24ade8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea18b62c-8052-570b-b42e-2792fe6c6972", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e82a89c-7b1b-5f58-9c70-b930b7e48683", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fd37e00e-d25d-556b-b5db-46ccdbb85bec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3984b8f7-626c-564a-a433-b5c8d60c5b75", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19ee8fec-e18c-50ad-8f73-02d870acf960", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:557a9bed-3582-544f-8c89-a6482d1a478c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74f9482c-fbac-5020-9e32-8432b73f801a", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e2ab8bf8-2aa3-55fc-aa78-4973cf70b2fb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a1dd50fd-fe6b-5c5c-8207-5b4a524fc02d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:786bfe75-0689-5634-b4dc-b5cfe922f76d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d87a9f07-767d-5b27-8e0b-26a756d86687", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4df2799f-464b-5e58-b03e-fd5a5d7e5622", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:856954ff-b400-548b-b068-5f8d561a30af", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9fa1cfb5-b86e-56e7-8f8d-2f48dea2f9bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:860c21f6-fb3d-598b-811b-a0663e83a190", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9c8cc9d3-64a7-5c3c-8ae3-c302307bb39d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4cd370b6-6e6f-566d-93b0-a6d83b46cb60", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3462faff-99e2-5ac6-ab64-e0a08c2cae29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d9808b4b-44e4-57d5-8f1f-1fa3676bfc68", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:624662ff-3fa9-53c1-bbed-9e4b35aec501", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0e010e5a-0140-5922-a60f-52aac2093b92", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:46b03a41-3205-580b-b739-44b3368099aa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:849538a9-ae32-585a-9aa4-64bd95e0544a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3b78e23d-4af7-559b-8b4f-c23c5e041faa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c53223e6-3228-597b-9f0d-cc1377c744f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a90288bb-9ebc-50e6-8ecb-340f47ff45e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:950ab933-4f1e-536a-8989-756f3f06e3c3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e5256495-1bea-5329-8c2d-98b595078e85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:61d8c1db-428b-5cd2-962e-3666ab848249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:feed409f-d7c5-56ed-b532-5eacd9cbfb20", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3c0d9c58-8e09-53ad-97d4-80dec6923afd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:826e1788-787b-5e1f-b99a-4698580fb37d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1dbd2531-6be4-561b-8cd3-810256afb106", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f1c91db-cb04-5d10-b93c-9c0d12fc114a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b20a6d4a-c9b3-5857-8b85-4ebaed6b1431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5d9e791a-e8f6-5769-8876-8a082dd90e58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ff20ab49-5bd7-5520-bd81-6d9439517ba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97d913ce-7cec-5aaf-98da-1ba549460eba", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:839e51f5-d553-51c5-80a5-7bc5b13f9f3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:16b6070b-40b5-5da6-8a2b-f3cd5c5dfd30", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:589bab83-aabc-5f7b-b416-89658864c88c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7cc4cf35-7c03-59fd-8458-fa70ee33f797", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d239b0fd-e819-5e3c-b0b4-e3aedd803178", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4bcf0bab-4125-52c8-bd78-ee75f92de7c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1b6d5df-a484-56c6-b190-098f93d5f090", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:68d642c3-3a61-590f-bebd-2311512a165c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-webmvc." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-webmvc@5.2.8.RELEASE-tuxcare.2" } ] }