{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:eb90fc28-1104-5706-95c8-18d8505be4aa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:db1c4cdc-bd01-5ac3-abd7-c8db4c161500", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:809cabd0-b7ba-58e1-bcd5-c747c9000d36", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:05b06415-1c26-5dca-b261-e54a1b8fb713", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7462b25e-2728-540f-8d83-3c6eb3ae0af7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d6f8efcf-0f6a-5cea-a9d9-86a25ca6ee58", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d83f14de-ff59-573c-be78-914eee535213", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b366ffff-5820-5689-aec9-835de79e4179", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0a4cf757-ec4c-5e26-9dbc-4c27fb8b87a5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6bba354b-938e-5a4f-aa39-b4fa222db0ed", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:5a908bb5-41af-5173-8060-2a8479c7b2d9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-expression. not_affected \u2014 CVE-2018-1257 affects Spring Framework versions 5.0.x prior to 5.0.6 and 4.3.x prior to 4.3.17, involving a regular expression denial of service through malicious STOMP selector headers. The target version 5.3.29-tuxcare.12 is not affected because the fix was already present in the upstream Spring Framework 5.3.29 release. The vulnerable code pattern (unconstrained parsing of selector expressio...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:72d5bd16-afe8-5ecb-9fb7-a5a6521aa1d4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8b174f1b-768c-568a-b48b-f420c07542b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:6e9f7605-3f54-5287-aa75-82c1e4826400", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:96a7c38c-7ab5-5138-8bb1-550b7de0f4a8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b6bcdceb-0645-5883-878b-1465e9f4b384", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:15cc36a9-9bb9-5425-8e03-838083f1e007", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:325b30ba-abfd-52ac-85f0-a05131da679e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:81046c39-0553-5ca9-a93e-b264785d8084", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b7d04db6-069a-5599-8799-2235ba550def", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d3103111-b13f-58ea-a99f-690613b33980", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:de34ff7a-614e-57c4-8400-b6536fec3f00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bf677139-4a5d-57ee-892e-34fcd665f8c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8cfae27c-ee38-5554-b3be-1aebb30c9ef1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:746674ef-e017-5c02-829a-ed82e485f8ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:efd63241-83fd-55f1-8ec2-85fe1b3162c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7da3219c-f1a7-505e-99d5-b2b7a9eee399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3257f51a-2338-5e70-8225-099b273a0a8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:631018d9-cfac-5bb7-857b-dccc2cd6fc83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:56684757-b0d8-5403-a24a-739175d89aea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ] }