{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a23d5de5-6f58-51b7-bbd0-46feeef5ec28", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2", "version": "5.2.10.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.2.10.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.10.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a1d2401-d4fd-5cdc-8291-358d0f38e805", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4c553d7e-7901-5ddf-92e1-c9d75b53804f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:74e753af-b522-527f-a8d1-f51751e8141b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:303468e8-23c9-53ae-8c06-622dfeb6b0d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8a1c3a4b-ff52-5a8b-beff-8a0bc625657a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:33e87f1f-ec52-5fef-93e9-9bc5e3c98909", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce1bf2e4-ee3c-569f-94f9-bf6d8792a5b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7fd3b85-6684-5e65-9bd6-ec2d48408c6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1413265-1a3b-504f-a17c-ced8e3b24570", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b9134a0-6c7d-5a3d-a94e-e896c66c4a33", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1ad56d21-6f82-59c9-bf18-8b286414feeb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:72eb248f-be26-55ad-92b4-c92036a0d492", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a8395e5-f6fb-5586-b39d-862aa5143175", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9225cc6c-f452-5660-b636-51f37eca3245", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:93b194ad-4ecb-55ca-8c53-d25dbcc570cb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:088f25a6-60e5-5c5a-b432-cfd1d1f8a264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7f781a84-435a-50ad-b9f4-cb2c57f5ab73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a11aecf-504a-564c-a22b-4e1e49a9efcc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:254718f4-f71d-51bc-b6c1-71a24ba29e9b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 Version 5.2.10.RELEASE does not contain the vulnerable code pattern described in CVE-2024-38820. This CVE specifically affects the fix for CVE-2022-22968, which introduced case-insensitive field matching using String.toLowerCase() without a Locale parameter. The target version uses case-sensitive matching and does not call toLowerCase() in its DataBinder field validation logic. Therefore, the l...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:945c3845-bceb-5f56-9ed0-97729637e0f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ed01159b-9496-569c-8d80-4e7fee883be3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7275f493-4a55-500b-ba2b-bce7f9b6694b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:eb8f3c86-e1d0-5d04-882a-0abfea210bb7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e8a1edde-16fa-5a44-adb2-d384e1895e32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5cf3c075-f659-5195-8952-5b85cd0762d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2bf0d720-b12e-5516-a45a-38d98c6dec72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4139da3d-9b04-574b-93b7-e639a1c9bdad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:52663906-b88b-5cd2-b700-ca79d75c58ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:11ee0d11-bcf1-5ce6-9958-7a1ba5444b5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:014b0894-3afd-563d-afea-272a27f02a54", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a4ee6c49-468d-590f-9230-94ba1ecb9a12", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 Version 5.2.10.RELEASE is not affected by CVE-2026-41840. The vulnerability targets the PartGenerator/MultipartParser multipart parsing implementation introduced in Spring Framework 5.3.0. Version 5.2.10 (released October 2020, before 5.3.0) uses a completely different Synchronoss-based multipart parsing architecture that does not have the vulnerable BodyToken buffering mechanism. The vulnerabl...", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:05667a9a-2975-5352-8988-e6c9059b72a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e1667767-7c55-54cc-88c6-899c61d27e9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b4d1f931-77ec-5c54-83dc-a63b8a208ed5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4e55d65d-576a-5b12-8626-57a299a58e12", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:89b828cb-a666-518e-8962-542ed9cba2be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ea45a738-591d-59d7-a190-9c5fb1de832c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d239b55-147c-5517-81ce-801b4bfc508b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6b8eac1f-45f5-549a-b1e8-a515f3fdc22a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:155487ea-b41c-5851-8b2b-4e5c0cc9cd17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56378824-3369-5d53-8a2c-90834efca9e2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c1edb783-c0c0-532a-8d34-74009ad041ec", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:56271d46-9728-591e-8121-fe81e2ac14a2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce810795-f13a-5441-890e-0d5c3d6ca162", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8a14e856-d11e-51d9-9ad3-4ffb740fa575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ba6a5209-6074-573b-83a9-89352f449742", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4a6bc52b-1c3b-560c-a630-855580c53815", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b1a3eb61-c11c-5d57-be75-6e52c601f7f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e518c5b-7e6f-5b10-a003-811a768c1e05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a305bb52-45f6-544c-b896-496a82e026a4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:faef67bf-e70f-5f54-9420-7e89d63a637e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring. Spring Framework 5.2.10.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns SSE (Server-Sent Events) view fragments, a feature introduced in Spring Framework 6.2.0+. Version 5.2.10.RELEASE predates this feature entirely - no Fragment class, FragmentsRendering, SseEventFormatter, or SSE fragment formatting code exists in this version. The affected code paths were never present in the 5.2.x release line.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a61d80e-f919-5b40-9464-365e12d6e266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:124625fd-94aa-5d09-8c7c-f94651c47502", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7009bb8-64ec-54a2-8963-62a78acf52f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0106385a-7d42-5ade-9fad-f14dfcf1dad1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d6b03253-2b2b-5814-8ace-2bcda355fdac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e70a6fd8-9eb1-54c3-b1b9-0cff565e0836", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18082aef-940e-5538-8d61-106ca18e53f9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c2ccec4f-3ab3-5559-bf31-4dc58f149822", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.10.RELEASE-tuxcare.2 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.2.10.RELEASE-tuxcare.2" } ] }