{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:c3e3e8d5-2f6a-5ff9-9484-7bae697bea54", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring", "purl": "pkg:maven/org.springframework/spring@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d07debd-15f8-50a1-a1b5-583f715ce016", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1878aa2-9002-5ea6-a8a2-75d901ccb916", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2b4eca59-7fd0-5259-854e-27eb46208e1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:73a727dd-e317-5770-93a6-2bc10928f350", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:98c11cdf-29e3-50ae-b618-5af9bd86308b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9d14363e-47c0-55bf-a35c-f3af66beff14", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0cb3d06b-a0cd-5113-a4f0-eea83b8f1d41", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:28cccf3a-2de5-5a0b-9d3a-ea9b4e54f74c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ce8ee03d-4469-53f0-a5df-56698d5eebc1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2429a2c5-5d02-5988-a479-3c164d21fe59", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:10804e90-5851-53f0-9fc4-91f6128cde3d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5b4ecb13-3e39-58d9-be86-654f24b8054f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:49bee22a-a7e1-52fc-b1a9-d95419611007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cfe79e27-43f2-5774-9c7b-0031fb3c6637", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5a91e7a-b780-54ec-84b8-296edffde7f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:173d6eeb-fc17-5bc3-bed6-9c1dbeeeb890", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cbeebe4a-fb9d-5421-9f08-cf6bd2b47d77", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6039765e-b925-5175-ae3f-c539f3cbdcc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3a4f05c0-a44a-51b4-8ab4-c0f9cfc606e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:bc5fe3f6-976a-5235-9d49-a83dc50d391c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e7cdc1eb-ab45-51d2-9eb3-eec37de93b59", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5e2cb7fb-f782-5602-8d46-cbffba9df74b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:120a38a7-509b-546e-9be5-d4d28d73cc56", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:86132eb3-bf94-5d6e-9642-7d0290406fdd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d1190f39-ac86-58bd-928a-50da3927e847", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4d3a7291-1969-5ae1-b154-78d24a17e5c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a1fcb82-cda3-58d8-980c-75e1fa922422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:077b65c4-e84d-55a8-9f91-dbab3a4fae41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a2fb0a6-7e7d-56cb-b74b-a487601e9277", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4bb29bd1-8af1-564c-84e6-63fc645f2cc3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:00d550c0-2ef5-5b5d-9a07-5263ce995344", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:111a8291-a39b-51b2-81ae-eed8bb23c946", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:77b6981d-ae4e-50af-99a7-1e53a4d2f97a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:05f66ed1-c102-5ccd-a2b7-21da7d8f05e3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8841afc1-7cac-5ee6-bdb2-aac5355b30eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:25ea3f75-b281-5d5c-81e4-467b12277fa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5a57ef07-1833-55c3-8126-7ce60993a7b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0511ac63-d4f6-5ce3-bfca-623a4cf7a632", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a5179daa-e2d4-5e54-9e2d-8343221f95ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0fb15f0a-c9ac-53c6-bb64-4db5ec1eb7d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:294eddc4-e210-549c-bf47-dcc1aecd1fb6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ccb6e1b1-b452-5371-93bc-acb109a1bb71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:917e1831-7257-56bc-a013-54f8445d1971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e11b6611-20f6-5ed8-a3df-cad854e16b86", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4ee06728-61d3-552a-93c1-22d5c32d932c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8b45f94e-b947-5816-be61-bdb339d0dcac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f23aaa3b-d13e-550c-bfee-e37eb8e6e759", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9012d76a-5cae-5560-a5ed-a5a6fb86b2d9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b56ffbab-bf04-5b87-8d3e-1223306e60d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2a844c6d-2f4d-5777-b844-5f6a68ce1e83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:c83d0a90-201f-5bed-9d04-1d1b5451676f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:fbdb73cd-1fb5-5569-a571-bd258c63bed4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d55224af-fdea-5bd9-a75e-b0930d636c45", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d992f84-19ee-535d-b04c-b4d25fe154d0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:daed3adf-4aa0-5eab-9748-87eab310698d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d204ebda-1b8e-568a-8172-cf6f26046bdc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6c58a4c8-41cd-585f-8c33-39a185a688c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c9ac8ea-a802-501d-bc69-d216d6331c50", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b3bb44da-e716-5649-8036-8c84ddf4de90", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:225c11dd-78dd-5bc2-8465-658458341077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:19943064-1017-5208-96ec-75113e4b6077", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:b5bcf76d-bba0-5ce2-a4f7-e7bf3a703507", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring@5.2.8.RELEASE-tuxcare.2" } ] }