{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:8bf0df4c-5112-53ce-bc31-a9a49c6c7948", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2", "version": "5.3.33-tuxcare.2", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.33", "type": "library", "group": "org.springframework", "version": "5.3.33" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:8027c874-2d08-568f-a3e6-690008667905", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:1242d821-5bf4-5849-a814-020292bac46e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:5e3c9d39-b715-52df-8fb0-ac1cf707102d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:ff42468f-1964-5487-89ea-7dd56f565ae1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:8b0f12ef-f9cb-5367-9056-851a68620646", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:de0b4cb6-c7f3-56b7-9efd-0f965b4a41ca", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:9a43092f-3e46-55a2-92ce-23750baa3b51", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:9e4175f9-7aac-51d9-851f-5a5617f81a94", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:70e2dd77-a89b-562d-89ab-57f13c8adba7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:4a3aba24-6dae-5473-89cf-fc0080a16900", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.33-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 The target Spring Framework 5.3.33 is NOT vulnerable to CVE-2018-1257. The vulnerability allowed attackers to craft STOMP subscription messages with malicious \"selector\" headers containing Spring EL expressions that caused ReDoS during parsing. The fix (commit ff2228fdaf by rstoyanchev@pivotal.io, April 2018) was already present in the upstream Spring Framework 5.3.33 release that TuxCare onboa...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:532dc15e-7f7f-5696-af0e-8279b93657e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:486fb24a-e992-59c2-ab3d-ec7640c1441f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:c858eacb-5679-5fa6-9df3-93b37bf8572c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:41680de1-8439-5444-9b27-f01513f4e9bb", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:02c89923-1eb1-5444-a4de-ac38cff2818e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:587fc7bb-3eda-5be5-ac6e-9dfa4dbdc789", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:46a6b28d-8caa-5732-a9cf-fe09ed7d7865", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:3ea4c575-a367-5744-9dac-b9e74de118e6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:fd6f5d17-b223-5263-966d-1fa1a5141674", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:914cae74-a412-5337-89fc-cf6113758db5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:32d8c57a-efd2-5b5f-8a0e-f741333be5c9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:046ca2cc-b353-5720-887d-f19eb5dfee70", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:acc6f4f5-deff-5246-9440-efe93032534e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:750d7423-6b4d-5678-af8b-2bed823aff29", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:8158a546-6e83-5247-ae05-95c79fdfd19f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.4." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:b5d6ab6e-8cb6-5cec-9b65-9bd9a6fc9d1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.33-tuxcare.2 of org.springframework:spring-expression, and is fixed in 5.3.33-tuxcare.3." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:f43fd298-1976-577e-bf22-22e3c4d69c23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:39cadae6-d1e6-518e-b0a0-741b802e9638", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ], "bom-ref": "urn:uuid:cb4ec108-25cb-55cc-8165-836e68534146", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.33-tuxcare.2 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.33-tuxcare.2" } ] }