{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:28a54adb-762c-5eaa-8e67-610797929953", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1", "version": "5.3.32-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:d1f6dd4f-f5d7-503e-b9ca-7efff251d076", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a2f5dd72-0920-5574-87fa-f31d7f13584a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:373cbfcb-4a80-520b-8402-025293a2b6f0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:46b047e4-3546-577b-99d4-644e9c6ec969", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:a8870977-1a95-5e7a-b55b-7184350eedbf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1580d0c9-a247-5d40-9d77-245d7437610b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:5b1889a4-54da-5d14-ac83-d70930cab66c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:dba07272-074d-5f1e-b87d-d66666432420", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:cb89aefa-39d3-5032-9e89-9b3732b66eaa", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:ccdb0905-2cba-518c-bf9d-8ada8f8b7256", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:8b70f1c2-57d5-5842-b499-65bbe071e617", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:f90d2b9c-8062-5807-9d3e-36243d8610ab", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:1ecd7b43-bc7c-5097-9592-02f9d68a73c2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:303aadaf-9ce0-55fe-9a5e-0d0e349c4e0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:bdadf215-5966-55ba-9177-3d3a1c092580", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:28312434-498e-5041-bf95-c06f8a0ac099", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:25d15383-22b0-5bd4-bf8d-bc6f5c83c796", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6a1a6694-f257-54b5-9573-45fa78599774", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b8042206-377a-539f-aac0-90edf3ea4d56", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:7f3a05ef-31fe-5d88-8af4-6f7f89ae337b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:778b0878-a2e5-5497-a754-9532bc018570", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:75cdad1a-fc48-5b65-b386-92a28176fc3c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b16a70e4-a6df-5790-9a46-7c3310f9c047", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:0ac311f3-448a-54a7-87cf-4e457fbb6710", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:2e6d63ee-1a84-5b53-88fd-c02f4c37995c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:b457d03a-14f7-528b-aa26-afd5be98ac78", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.32-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.2." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:2259cfd1-2fdc-51f9-9ca1-c2da8674ef9a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:6d20023d-a34b-5cdc-b849-150a40fd6fd4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ], "bom-ref": "urn:uuid:3cdcae43-aa6c-5971-a3a8-ac0cfa0a17a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.1" } ] }