{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a93b0db3-83dc-56b2-933e-9f852354976c", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2", "version": "5.3.32-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:9f658c94-5330-531b-b029-5d266ca5f797", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:3e6468d0-7f8f-54b9-966d-c5a1fd3446a3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:24bf8c58-0845-559a-8bac-67a3aa946fb8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:0895a393-5004-5689-be1f-9b11d7455540", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:42418a56-c3a0-52c0-94e1-225593ac44e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:a2c34df0-3d12-50a6-8045-2e34c3f26c22", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:596c5656-16b0-518d-a43d-32e3d8dbb0e9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:2939884b-363f-5346-92c0-a7532a32c74c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:cc823e43-8d6a-50d8-951b-3cec4ac1fb6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:efd51cf1-59af-5ea8-a157-c84edfa1e0a8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.32-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 5.3.32 is NOT affected by CVE-2018-1257 (STOMP selector ReDoS vulnerability). The upstream vendor fix was already present in the 5.3.32 release that TuxCare onboarded. The fix adds a null-check guard around selector expression parsing in DefaultSubscriptionRegistry.getSelectorExpression() (lines 162-164), allowing the selector feature to be disabled entirely by setti...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:59866002-7050-5650-bd45-12ff3b76165b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7d3db2f5-19c2-5e00-a7ea-9f5e3e3465ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:c391437e-3235-5426-93a0-d4a7fe4e43e0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:7f6f0e27-efcd-5462-aff0-04addc9233d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:00eebf17-6d60-531a-aef9-fc023820b005", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:bc75acdc-1903-5222-a735-f40f56bf0d0c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:ffae0f6d-a4d7-53a8-842d-9cdcb5f4a965", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:00104a6d-1f2a-51f6-9ffe-05c3594a0eef", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:824bc21d-d97b-5e16-a92f-c7f9c03e7f64", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:4e7aff92-04c7-58f4-b5c2-7e1cbf210c5e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:8177142e-cc75-54f4-96bd-55a1de7769be", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:99636304-e677-593c-a704-8aa5c4fcca0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:1711879a-809c-5dbd-a5c1-aeffbda07045", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:9bb5c76a-ba94-57ce-9826-7affffa3f955", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:9a9e5e7f-72c8-5558-9db5-b5a489007bf8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.32-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.3." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:f644bb04-b67e-53bf-bef5-6117113b4cde", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:4d2c7ffd-8bcc-568a-9b5c-6bab89c02fcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:04fbea74-8e4a-5e5c-821a-21a9fac96cda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ], "bom-ref": "urn:uuid:2e7c7774-0bce-5d83-89bf-cbca256cf61f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.2 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.2" } ] }