{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:76facc3a-0ced-504d-b95e-110551a2d98d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1", "version": "5.0.0.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE", "type": "library", "group": "org.springframework", "version": "5.0.0.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5764bde8-8f40-5bcc-b9e9-275e1fbdf426", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2009-1190 exploits an algorithmic complexity vulnerability in java.util.regex.Pattern.compile in Sun JDK before 1.6. Spring Framework 5.0.0.RELEASE requires JDK 8 to run (sourceCompatibility = 1.8, per build.gradle lines 114-115, and README documentation). JDK 1.6 (released 2006) fixed the Pattern.compile algorithmic complexity issue, and JDK 8 (2014) is well beyond that threshold. While Sp...", "justification": "requires_environment" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:65532a18-9892-5011-95d0-1f7dd807b5ea", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:07cc1a73-d98f-5a9f-a77f-0a5c05713b01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4abc788e-c2d4-5105-980d-8abcd9e22b07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b55495ea-c5b6-5a6b-af07-5896ca7a02f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:227b2914-be98-5ec1-ab9e-5601df735f97", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e99fed34-d6d3-5c34-a5f1-e24710e3aeed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:38685695-ae81-5ddd-a53f-899a3b5ee73e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e0812c77-484c-5855-bf38-a1913aa3d030", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:973dc4b6-0d10-5eff-92ce-665b4bd53dcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:661a1e07-8b42-5498-a8a4-6bfeaa3b3beb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:23d857d4-dbd3-5110-9174-f8dfe758960b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8104355b-3840-5e29-8b26-23bf45a41fa8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9488e3b4-ad09-5c2f-8c15-ed9bd934ae92", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:212d028f-5530-52ae-8954-0a018c8e1568", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7a83af93-456b-5595-bce4-015aec7f376f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4998b4b6-a2f5-5064-a011-0611b87e9082", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6fb23a4c-b215-5b78-b50b-170fa4a02047", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec4fc3b4-d0ef-5929-90e1-0094b4e55389", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6257aef3-92fe-5b37-a0fb-d29031fa699a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e90a7d60-ac46-5c57-947c-5856d67f1d8a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:499e8c65-7afb-5c19-a4c3-6069918b774e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:72d1bc5d-ba43-5585-98ee-89e9bb924c3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3e354690-eee4-5b17-affb-e3b905990e5d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ebd5ff2-70cb-5b43-9299-bb46901026cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1a6298a7-a77c-593d-9985-865f17b740c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7284f574-33c0-521e-bd5a-5431adda675e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f5dd17ec-5eb1-5986-b23d-8a66d17277d5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3e01bee7-e155-5d10-bb62-2ffce73b9f03", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-59283 does not affect version 5.0.0.RELEASE-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.0.0.RELEASE is not affected by CVE-2026-59283. The vulnerability requires the SimpleEvaluationContext class, which was introduced in Spring Framework 4.3.15 (March 2018) and 5.0.5+, after the 5.0.0.RELEASE version (September 2017). Without SimpleEvaluationContext, the attack vector cannot occur. The CVE specifically concerns the SpEL compiler bypassing SimpleEvaluationContext...", "justification": "code_not_present" } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.0.0.RELEASE-tuxcare.1" } ] }