{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e98f5f73-fe42-5350-9bd2-c960bda38ed6", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1", "version": "5.1.13.RELEASE-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE", "type": "library", "group": "org.springframework", "version": "5.1.13.RELEASE" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:acf4785d-fad8-5f1b-bfce-288e38af17d7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fb52890b-2dcb-5b73-86d6-59d4c82e4453", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b3d93dd2-72d7-57f1-8ed5-7ba0d231f8c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:828e905e-cfca-5766-984e-ab2acb49dded", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ac9af21-e8da-5bac-85ba-16a1576b126e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:222492a0-a6e7-55a3-9077-9dba422f197d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:32eee874-8b61-5169-8d93-1702b5ff559a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:85600c31-2d8c-53f6-881c-b4cc7fed98d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f088568e-dab4-54a5-aadf-1972d00e259a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1e78be9d-3b3c-5db1-b8e9-989f9a0f20a1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6, 4.3.x prior to 4.3.17, and older versions. The target repository is version 5.1.13.RELEASE-tuxcare.1. The fix (commit ff2228fdaf, SPR-16732) was already present in the upstream Spring Framework release 5.1.13.RELEASE before TuxCare onboarded it on 2026-10-25. The fix allows administrators to disable selector expression parsin...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f8f3b5e5-6966-5b9c-bba4-a890c93fe1ff", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:18f31f79-68e0-50e8-9898-7c5cb27d1c0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:16010605-ec92-5ed7-bd7c-2a5603050a31", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb00ea68-2837-5fe6-9fb5-1ca49e69585e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7ed809af-b3c6-56da-bc90-83d2435e37b0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fa8b9ccc-f1bf-5c36-b571-208acc8137f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2cec8c94-6ae9-5e3b-89c4-d5a8ed507f52", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:135ac4be-8d97-5b8e-9050-c4f9752c8dea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:740785fc-24ba-5def-a3f2-0604ce546ab3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:abe4f5c9-52bb-5144-ac7f-9d25439092e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a08892d5-70ba-5da4-ab2b-41e1becafcce", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:460a7d5c-557d-51df-b397-1a7d7aa449a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6bd3b2d9-c0e9-5c9b-a48f-139ed497ae57", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:caada218-f031-5ba3-9aa5-11f2930029cc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:73985443-567a-5f49-b8b9-e20962fe91f7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50816fef-0175-5b37-b890-ea9f86152083", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:eb84aaa5-3dac-5b03-8af7-c85b630b7084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:a8d309f3-c3ac-50cf-b012-1f31fd648d3f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ec3ab776-4770-5bb5-8231-73079aa080e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.1.13.RELEASE-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.13.RELEASE-tuxcare.1" } ] }