{ "@id": "urn:uuid:2f3b0c0a-fbd5-4d9c-8a22-7642c77a6814", "role": "Document Creator", "author": "https://tuxcare.com", "version": 4, "@context": "https://openvex.dev/ns/v0.2.0", "timestamp": "2026-10-20T10:05:00.136501+00:00", "statements": [ { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "vulnerability": { "name": "CVE-2016-1000027" }, "action_statement": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-22243" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-22259" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-22262" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38808" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38809" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38816" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38819" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38820" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2024-38828" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2025-22233" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-10-20T10:05:00.136501+00:00", "status_notes": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-framework-bom 5.3.31-tuxcare.12. direct vulnerability is in Spring Framework project - affected versions are 6.0.5-6.0.27 / 6.1.0-6.1.19 / 6.2.0-6.2.6, version 5.3.31 is not in this range", "vulnerability": { "name": "CVE-2025-41234" }, "impact_statement": "direct vulnerability is in Spring Framework project - affected versions are 6.0.5-6.0.27 / 6.1.0-6.1.19 / 6.2.0-6.2.6, version 5.3.31 is not in this range" }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2025-41242" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2025-41249" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2025-41254" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-22735" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-22737" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-22740" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-22741" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-22745" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41838" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41839" } }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-41840" }, "impact_statement": "already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches." }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41841" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41842" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41843" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41844" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41845" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41846" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41847" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41848" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41849" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41850" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41851" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41852" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41853" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41854" } }, { "status": "fixed", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom.", "vulnerability": { "name": "CVE-2026-41855" } }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47884 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-47884" }, "action_statement": "Vulnerability CVE-2026-47884 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.15.", "vulnerability": { "name": "CVE-2026-47886" }, "action_statement": "Vulnerability CVE-2026-47886 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.15." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-47887" }, "action_statement": "Vulnerability CVE-2026-47887 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47888 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-47888" }, "action_statement": "Vulnerability CVE-2026-47888 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "not_affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-10-08T08:18:33.187222+00:00", "status_notes": "Vulnerability CVE-2026-47890 does not affect version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom. Spring Framework 5.3.31 does not contain the SSE Fragment rendering feature that is vulnerable in CVE-2026-47890. The vulnerable code path was introduced in version 6.2.0 (July-August 2024), after 5.3.31 was released in November 2023. The SSE Fragment feature uses view fragments sent as Server-Sent Events with improper CRLF escaping, but this entire feature does not exist in the target version. The general SSE support in 5.3.31 already has proper CRLF escaping from a prior CVE fix (CVE-2026-22735).", "justification": "vulnerable_code_not_present", "vulnerability": { "name": "CVE-2026-47890" }, "impact_statement": "Spring Framework 5.3.31 does not contain the SSE Fragment rendering feature that is vulnerable in CVE-2026-47890. The vulnerable code path was introduced in version 6.2.0 (July-August 2024), after 5.3.31 was released in November 2023. The SSE Fragment feature uses view fragments sent as Server-Sent Events with improper CRLF escaping, but this entire feature does not exist in the target version. The general SSE support in 5.3.31 already has proper CRLF escaping from a prior CVE fix (CVE-2026-22735)." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-47891" }, "action_statement": "Vulnerability CVE-2026-47891 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47892 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-47892" }, "action_statement": "Vulnerability CVE-2026-47892 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-47893 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-47893" }, "action_statement": "Vulnerability CVE-2026-47893 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-59280" }, "action_statement": "Vulnerability CVE-2026-59280 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-59281" }, "action_statement": "Vulnerability CVE-2026-59281 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-59282" }, "action_statement": "Vulnerability CVE-2026-59282 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59283 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-59283" }, "action_statement": "Vulnerability CVE-2026-59283 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59313 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13.", "vulnerability": { "name": "CVE-2026-59313" }, "action_statement": "Vulnerability CVE-2026-59313 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.13." }, { "status": "affected", "products": [ { "@id": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12", "identifiers": { "purl": "pkg:maven/org.springframework/spring-framework-bom@5.3.31-tuxcare.12" } } ], "timestamp": "2026-09-24T09:31:26.931840+00:00", "status_notes": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14.", "vulnerability": { "name": "CVE-2026-59314" }, "action_statement": "Vulnerability CVE-2026-59314 affects version 5.3.31-tuxcare.12 of org.springframework:spring-framework-bom, and is fixed in 5.3.31-tuxcare.14." } ] }