{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f3a5d793-e25f-5194-aaaf-a6614cc118d8", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7", "version": "4.1.7.RELEASE-tuxcare.7", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE", "type": "library", "group": "org.springframework", "version": "4.1.7.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:24fc317f-2eac-5938-be9c-3477570db248", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2009-1190. The vulnerability is fundamentally in JDK < 1.6's Pattern.compile method (algorithmic complexity with regex patterns containing multiple optional groups). This Spring version requires JDK 8, which is 8 years newer than JDK 1.6 where the underlying JDK issue was fixed. The target version (4.1.7.RELEASE from 2015) is also much newer...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:00366ab1-d246-5314-9b7b-3f7158d80e3f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:63cdc495-bba3-5914-928f-c8334985b985", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:cfa37be2-4277-5f17-8109-264de941e869", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:002f3b0f-cf2d-5078-afc8-f972221e5858", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e7209638-7ec0-539b-93f0-e62fe6beedb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2015-5211 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:30aebccd-7a59-5371-8f18-80c40866bc84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8d4a86a0-51cd-5e71-b0d7-1b75fe761e75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:722767f0-aad9-54bb-babe-b68303fa5260", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:b9955707-6fd5-55fc-aa97-60c8953eba31", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression. The version is not vulnerable. [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:2d0417dc-f349-58d1-b94c-370e915c425e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4c78205b-4a9c-5ff0-98a7-ed6881bc9b8c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f99de1b0-5115-5ee4-98ab-92b9ffaeaa1f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8459ee6e-bd74-5104-8424-0636432f7fe3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:89faedc7-08d8-5634-a151-630bbfbc162b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:4cbe4263-773a-5e9c-8de9-9c4f3d499e2d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:19d223ba-6e39-5edf-8516-f1680b79a048", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:31f310c4-fdd0-504b-b814-5e3d61814a94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:bf59c280-892b-562e-a6d2-d99415ad2388", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:dd61dcf4-8c1e-5a12-88b0-bbdd575ff31d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e0e0c666-e1c0-50f7-a7fa-6a6ef4d4fbe8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f11861e2-ccb8-576d-a027-f1583bacdb72", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:5d12fa8f-c468-5e49-9bf9-799ed7cf6bf1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:90051721-7376-5c04-a981-dddf5c9560e6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e67cc93e-d415-5960-bf7c-3556f4c292ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e8d9c8bc-50e8-572e-a86e-952ee13d44a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:f7289f59-0443-507d-a58d-84224dc98397", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:8b17eeea-ed9f-5d0c-9098-6198784d905d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41852 does not affect version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.1.7.RELEASE is not affected by CVE-2026-41852. The vulnerability requires record-style property accessor support (empty-prefix method lookup), which was introduced in Spring 5.2+ and does not exist in version 4.1.7. While this version lacks void return type validation for getter methods, it cannot invoke arbitrary zero-argument methods as described in the CVE.", "justification": "code_not_present" } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:1552c5ed-a7da-5729-8256-c0b393efe44e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ], "bom-ref": "urn:uuid:e92a3ce9-4a17-561b-9972-b1a453d4e9c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.1.7.RELEASE-tuxcare.7 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.1.7.RELEASE-tuxcare.7" } ] }