{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9a121194-9d71-5fc0-87e6-f5103fcb6f86", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5", "version": "4.3.4.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.4.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:deee3850-b290-5905-8276-0b8a8c8987f3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:a7963160-deec-58d9-bd24-3795207a655f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b0d6ff8c-b591-59d9-a32d-5a7aa222fe4d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ea24e019-3b84-514a-86a8-2b2efee7c048", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6423083c-ab58-552e-8efe-ae0bef3ff2ef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:371bb4a0-868f-5a8c-90cd-50f923cd57a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1ad4f90f-3619-57c6-a7d5-18b7d33dfdd0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:85ba861d-697d-5acb-978f-f1814e3e87ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:51ad484c-e9c9-5bd0-8165-88133030f01e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f4f2932b-73dd-5de2-8771-b1539c78eb47", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b16d85c0-e5fb-5927-96aa-f2cf6cbafc96", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:79ede433-26df-5837-bea9-405c376f4db7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2e09ee13-728b-54b8-aebc-8a5a0871f506", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f7382c7e-83ec-5fd4-8a69-f0bda4926a6d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:50d2f15e-d141-575f-bb75-4ba51b86b6cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7bd720a6-773e-5cc9-a373-2f43b7062ac7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:43167f4b-ed34-5856-848e-6389a2ea847e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2bedf7f5-3ca0-549d-a0eb-642211e4095d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:2f52e1e5-3a74-5075-9b36-69d4bc4318e1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:4f327381-2713-5e87-acb5-086165ab4688", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b797c317-e816-538a-b068-50875ec78001", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:68116e87-96b4-5947-b86a-a87d59922cfe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f90ce7fb-143a-5504-bb38-36a3182f8635", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.3.4.RELEASE is not affected by CVE-2026-22740. This vulnerability is specific to the reactive WebFlux multipart handling introduced in Spring Framework 5.0+, which does not exist in version 4.3.4. The target uses servlet-based synchronous multipart processing with explicit cleanup in finally blocks, a fundamentally different architecture from the reactive stream-based approac...", "justification": "code_not_present" } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f103e4f3-9d94-53b3-875f-bbe37524a19f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:375cb40b-c786-5af0-b370-ba855884a743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e714f287-13dd-59cf-868f-8a26c10117eb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c284ec0f-6c03-5c69-8e81-2a4d4fa7dc5d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:d572f296-43a2-5e51-8b76-e013eaffb8c6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ff140dd0-4515-5c3e-964e-83252422228e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression, and is fixed in 4.3.4.RELEASE-tuxcare.6." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:6e95154a-726d-5891-9095-22f2262a4f89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.4.RELEASE-tuxcare.5 of org.springframework:spring-expression, and is fixed in 4.3.4.RELEASE-tuxcare.6." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.4.RELEASE-tuxcare.5" } ] }