{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f29de407-8222-5677-83c5-7508a09f1a00", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5", "version": "4.3.9.RELEASE-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE", "type": "library", "group": "org.springframework", "version": "4.3.9.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:78ca95f7-57fd-53c2-b27e-7c1a13295529", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 CVE-2009-1190 is a JDK vulnerability in Pattern.compile() affecting JDK versions before 1.6. Spring Framework 4.3.9.RELEASE requires minimum Java SE 6 for runtime (documented in whats-new.adoc), which includes fixes for the underlying algorithmic complexity issue. While PatternEditor still calls Pattern.compile() without input validation, the exploitation requires JDK before 1.6 - an environmen...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c72573c8-4763-5307-ba57-4eaafd465bf6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e4eba16c-62ab-5a7f-942f-cff4d2ee6aa9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f471a2d2-7982-54ef-9851-b214d087034e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:92e5407f-390d-5a4e-9d08-a5d89c22c7b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e6f57d68-65e9-55a5-8771-ab3095b487b3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8454937a-bbc5-535f-930c-672e8ff2a524", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:bfb92112-3726-52a8-b520-4fbcc390b4cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-11040 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:dd9b0645-2f98-57c0-bd6a-7a5026894eb4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:06ee8cc0-064d-51c4-ab32-2c518f69f027", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ad0ad0ab-7377-584c-a4ed-87b98176a1f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:779e1e0c-9241-569f-b668-6c12ac354476", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8cbe249a-fba9-55ab-a540-a819bcd760fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7ad63b50-c305-52f5-9489-3475f874a370", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:49f9102f-0386-599c-8c0a-17051003d432", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:b348bb77-345f-5d2f-9c6a-0d09ac00c08e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:1a3cdcda-5555-52e5-aa51-31288e9d9bfa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:3131d2f4-4ea0-56e2-bf61-e5a0f5547639", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:f9f73138-6389-57fd-94fc-f175b813d7af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5700ae9e-f0ec-5875-8531-ca7c725633c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:7409c5c7-ad11-5f6c-ab6f-fdeb1f088f62", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:14ec1c57-aab0-5147-bd5c-6c6e8edd5a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:df09d25b-3b10-5507-8751-351b7e579215", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:ded243f6-f51b-5510-af82-61c78e4f18e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:e9b696a0-4e12-57a9-9414-02779a143cba", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:9af4861a-9eed-573d-89ab-d97e1f981e88", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:5f8a2b3b-3a88-5722-b159-151b6ff67fa5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:8be7f727-20f9-5f5c-b1d1-f6b31cb9b613", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ], "bom-ref": "urn:uuid:c5c7e6af-c3f1-5efd-9205-5fd18d1dc55a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.9.RELEASE-tuxcare.5" } ] }