{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:6bb00b28-401d-5cea-bc32-58107c18cbae", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1", "version": "5.3.33-tuxcare.1", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33", "type": "library", "group": "org.springframework", "version": "5.3.33" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:791f2ec7-e1e5-50ae-b93d-bee9777e60ed", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2009-1190 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.33 is not affected by CVE-2009-1190. The vulnerability requires deserializing untrusted data containing malicious regex patterns, which triggers CPU exhaustion via Pattern.compile(). The upstream vendor (Spring) mitigated this by deprecating all serialization-based remoting (HttpInvoker, RMI) in Spring 5.3.0 (July 2020) with explicit warnings against exposing these endpoint...", "justification": "protected_by_mitigating_control" } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:ee77db3d-d3b9-510b-bbc3-454f4969b118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:6255c9cd-edd5-5552-925e-734ad3e9b028", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:b3b661d1-f159-53d4-8310-e65fc463372d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a39d44c5-5433-59dd-8821-123172b2af83", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d1816ed7-4f91-5495-8bc8-fde4fa6b4a6d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:22343bdf-0162-5e4e-b243-b08e79129be3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:74d352be-7aad-5d37-b759-ffac4434093e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d8fccc80-29b0-59a4-b698-b83a1c6df0c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:066c908e-fad4-527c-9616-506f49922910", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.33-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:e5bbbad2-505c-5065-91d8-b790f71a4154", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f9373e03-f0bd-54fb-a926-5c79f448abdf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0385c4c8-e94d-5deb-a663-2941c3427dbe", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a96b5ac4-29e1-52b1-8893-c1b955c4d9f2", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0f831605-1075-56be-a403-a820916cf56a", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:d5688fa7-f45f-5f27-ac44-b04af993ac5f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f134d599-73f3-5c1e-878f-ffcaca69df0f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:a77b9dbd-86e2-51bd-8565-24e85ba74e9b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:035afcf4-97dc-5e18-93be-1888f4b211f5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f34c4239-f97a-5017-816a-f61be0e9a5b7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:e9606a6d-8530-5c70-b20d-45dfd50058bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:dc5e7e58-9396-588f-b617-c1f4d41123e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:cb518506-cd10-599b-b94b-1f345ee8dbf7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.2." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:46866054-7cb5-500e-ae46-d7cd2964be18", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:9d992536-34da-5ae5-a767-534518555c32", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.4." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:8c877fa3-6556-5a02-b410-abe2ad3bd42e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.1 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.3." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:f1d0b3c3-9162-5fa2-b154-2e12495bb602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:68e10611-1635-5313-96a1-43243f50abbc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ], "bom-ref": "urn:uuid:0b505071-dba5-5da3-9707-91559e56ddcf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.1" } ] }