{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:dcc5b666-99ce-5216-a582-77ab4be55cd1", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6", "version": "4.3.25.RELEASE-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.25.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1309fa7f-0eaa-5b9e-8be8-20dfdaf2084d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:30d5c2e3-11b4-54f5-a4a0-b9b847ab5055", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:d676cf5c-8a92-5aed-8139-99901869ad81", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:41f8f69d-0ad1-5f94-8a47-18b05b7de1e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:3c3b5434-b7ae-5371-b3a7-4d9222347a48", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:f9c5ce30-13a5-5305-9957-279d3c1900c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:56d57276-34a1-5904-995e-8c130ce3a3de", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:59fda1b1-dbaa-51c5-a52e-22b33b13280c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:0eee2690-54e0-5632-9d0e-dc3868b54c32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:901c9c93-889a-590d-9cd5-6972fc3d79c6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Target version 4.3.25.RELEASE already contains the upstream vendor fix for CVE-2018-1257 that shipped in Spring Framework v4.3.17.RELEASE. The fix (commit 246a6db1ca) adds a null-check guard and makes the vulnerable selector header feature configurable so administrators can disable it to prevent ReDoS attacks. The fix code is present at DefaultSubscriptionRegistry.java:154 and SimpleBrokerMessa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:83133984-5e71-5d76-bf1b-c72ce653f3c3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:af03ba90-7622-503e-8181-e7c10a4333b6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:54dc3ca7-0232-532e-b329-0121b55a3d69", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:895d5985-1b6a-515e-99b2-484dbfda4bef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e7bb7fca-0dd4-50c8-8cce-af47c49775f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bea84a23-0e06-5832-8626-919dda177067", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:71aef23c-c918-57f2-9e5e-6d85336129c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b2da8ad5-e868-5150-af2a-cd246e8bc3bc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:b073d6a0-a572-53ad-963a-8d049e214601", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:65897a9b-f11d-5e56-9c37-9065417fad76", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:130c55ff-bae5-5791-ba55-eeadb9886c10", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:284c5a15-41b7-5f77-a9db-7b6291e209f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:6dcfebf0-f2a7-5552-8c2e-2c9854910bdb", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.3.25.RELEASE is not affected by CVE-2026-22740. The vulnerability exists in WebFlux reactive multipart handling (introduced in Spring 5.0), which is absent from the 4.x series. Version 4.3.x uses servlet-based synchronous multipart processing with explicit cleanup mechanisms that prevent temp file leaks.", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:1411afe7-17e1-5bc0-ad25-2e14c5927c0b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:fd648ab3-6c8e-51ff-8b9d-d4218c64b0ac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:94a2cbd0-4cb4-572d-b65c-e7408c97d6ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:e7bdb972-f8a8-50a3-af96-d07d4a90c00f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:bf8593bf-68aa-59a9-8ac9-4f706c773338", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:99e896eb-843d-52c6-914e-344b64ed4bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ], "bom-ref": "urn:uuid:a4e2b887-22ac-5cdb-b4b7-14bb479c94c9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.25.RELEASE-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.25.RELEASE-tuxcare.6" } ] }