{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5c287290-d6c6-5a96-aa9f-6a809d7d5eb1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2", "version": "5.2.8.RELEASE-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-context-support", "purl": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE", "type": "library", "group": "org.springframework", "version": "5.2.8.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9eac2fa9-c1fe-53e4-a9bb-c6e825861bf9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8d92ee50-dbef-517e-a9e7-a07a9981eb26", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2020-5421 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:27a2aa3e-0657-5476-9131-53ed5eb0df7f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:38ec7b52-4606-5671-97ae-2764d3d6c773", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3ff0d05-e901-5a7c-a5f0-993c00c58aab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:498f208c-210c-55d1-aa6b-4b7065b23070", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc6966b3-325f-52f9-aeb4-92338cdd7e6e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2f370072-5992-50ae-bab4-7f66dce09ffa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22968 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d515c16c-7fbf-5f70-aa3c-88ee237f5f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:267e8f67-7c7b-5a24-ad58-4adb0e7ba91e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22971 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dc18de96-2b0a-52ee-ade6-9bb6bbc78e5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f848364-715c-5b2b-b770-6a96c01fd715", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9775cb3-58ed-5983-a1b3-9d63d62a354f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2ddec859-213e-500e-a9f0-f0645f352385", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a3c7385c-ae28-565a-86cd-9c5f83b83c4e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:45194f4b-88c7-5e4e-bf4f-b5af74cc6163", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:dfd7809a-6d6b-557c-9db6-df97a68fc251", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38809 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cfd1b625-dbe5-5284-b939-f09a99fc99b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a25ba82a-87ff-5cab-bf88-f0f3a9da7f3b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:78d53906-383e-5dd0-8958-d1e31b51988e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Spring Framework 5.2.8.RELEASE is not affected by CVE-2024-38820. The vulnerability requires locale-dependent toLowerCase() usage in DataBinder's disallowedFields matching, a code pattern introduced by the CVE-2022-22968 fix in later versions (5.2.13+, 5.3.x+). Version 5.2.8.RELEASE (July 2020) predates that fix and uses case-sensitive direct matching without any toLowerCase() calls. The vulner...", "justification": "code_not_reachable" } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:4aec2e72-e931-55a5-bdb3-45c8fb699a5c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:ccbad2b4-3433-5d0f-a72d-0e342d2ed5ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1049da24-854e-5691-a7f3-726fda965ba7", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2025-41234 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support. not_affected \u2014 Version 5.2.8.RELEASE is not affected by CVE-2025-41234. The vulnerable code pattern (PRINTABLE BitSet without double-quote encoding) was introduced in version 6.0+ on Feb 1, 2023, approximately 2.5 years after 5.2.8.RELEASE was released (July 21, 2020). In 5.2.8, when using non-ASCII charsets, only the filename* parameter is output, and double-quotes are automatically percent-encoded because t...", "justification": "code_not_present" } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9563ead0-2d87-5805-a1b2-df6b807fb0be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:5146a456-3b54-57a5-ab09-f37bab755b73", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:46b560b0-c810-5089-807d-f15be489faf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:791b74f0-600a-527f-9071-6aa2ef9867e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9997d60f-6bf5-5381-b353-c28d8fa8a9ed", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:18c46e5f-fa3e-5e5c-a410-058955c99ad4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8e2ed471-4106-5dee-92ef-2e0272360269", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6cc229a4-1334-5ba5-9b0a-c56c792527e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6ddd8a2b-88ea-56c9-9a31-a5f5179df0a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6cbc09b8-5057-5823-b110-23c5580947fa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d7a9dc9b-6abc-5218-a64a-1a8e3469d7b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41840 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:9a49dd42-818a-5655-813f-cefcd48cb24c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:199d2fe1-909f-56eb-be26-2646bdb12f71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a4380382-4cb1-5102-9007-f424241d451a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:d2990035-9302-5410-8bb5-9dab17e7644f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:703cec80-cc24-50d3-8e43-b33601ac37e8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:540c4f5e-bc62-5ef4-8a66-5685b0de67bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1171f9fd-6f1e-5b35-b215-afde17ca40d1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41847 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:97f9b8b6-27d5-5a00-8d1a-b478928d7fd2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a9c75a92-b653-5518-827d-3bd3115ea320", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:41e559ba-4237-54df-88c0-b90ce60c0224", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:3938a4cc-28ed-5859-a63d-81ba290bf854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8dca16eb-7fc3-5ded-820d-984faf78fe85", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:f9dff80e-522e-5d88-b499-f20d792a98d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e11b79a4-e21c-59d1-bc54-39b53492bc49", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:593ce146-fa6d-515f-8db8-be426ebfe947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7ba0f35d-1586-5465-a561-ee3bfae625b1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:cd44d5f3-b75f-58da-b318-bd3f5c9ae5e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:26446191-ce72-501c-aa7a-8f7a445b9906", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:a2c38004-066e-5a63-865f-9725ead94dc8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:6f5f5cd3-6ca8-5b9e-a69e-f005d7bd8be6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support. Spring Framework 5.2.8.RELEASE is not affected by CVE-2026-47890. The vulnerability concerns improper escaping of carriage return characters (\\r and \\r\\n) in SSE view fragments, but the Fragment feature itself was introduced in Spring Framework 6.2.0 (July-August 2024), approximately 5 years after the 5.2.8 release. The target version does not contain the Fragment class, SseStreamHandler inner class, or any Fragment-SSE rendering code where the vulnerability would manifest. The vulnerable code pattern (text.replace(\"\\n\", \"\\ndata:\") in Fragment SSE formatting) does not exist in version 5.2.8.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:afecac89-bf27-5395-a5b0-27bbea3ff859", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:2f9ee292-a4da-5445-9346-794c28fa064c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:e73b792a-afdd-5a20-a88d-3bad20000c9c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:7c9a51da-598d-51cb-890e-b4345f014e5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:8c067936-2b40-5a63-a3ac-fcfb160f5a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:95a69d0b-9fbe-5997-b170-fa2defea9133", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:0f071045-209c-51a1-8113-67b10ad040d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ], "bom-ref": "urn:uuid:1917c556-9471-556a-8eb2-e7d78eebeee6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.2.8.RELEASE-tuxcare.2 of org.springframework:spring-context-support." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-context-support@5.2.8.RELEASE-tuxcare.2" } ] }