{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:ddd21c10-e8da-502c-b009-697150b1dedd", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11", "type": "library", "group": "org.springframework", "name": "spring-expression", "version": "5.3.37-tuxcare.11", "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:dc9f9b72-e0ef-5087-9cbf-5e83cb1d8e1e", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:42d7f918-9008-5922-9ee8-5c9ea9e58b64", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:acd9d287-0181-5353-a9c7-1774e81336ec", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9e6f3b28-8e18-5d99-873d-33be00084885", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f3edca9c-a89d-57ca-b417-f6020b4bef97", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:584c5d21-63e1-5304-9b87-49dc8485c091", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f47c9922-78f9-5d86-9768-b3526900cea8", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:90f9d709-6678-527a-8a85-6b0190710ccf", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0cef2e7e-9cd4-5a82-a93e-893edf964356", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b513842e-0544-5007-9a45-533b35d8a8f4", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f302bbd6-ffa1-5867-87ea-6f610f4abcd3", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:75b15b94-9ab5-5bfe-82b4-5572284985a1", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:0b0292c2-104d-5cee-945d-4a1966e18c9a", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e05325e6-6b71-5297-937f-940ab7175ff6", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:4b4bb9fa-5819-53bb-8498-8cc15bc084e7", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1f3b409e-475a-5fe0-aed4-48a2b5fbda3e", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e17fa558-5e71-5d0b-b2ab-63849178e17d", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:bcc32070-0b90-56e5-a2bc-fc90544f41a7", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9a32ba85-eeb3-578d-8f18-f699744aab9c", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:34ab67fd-50a5-5f70-b16c-1e26a421d0f2", "id": "CVE-2026-41841", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:48a53ede-d74c-5a5e-865d-f65f8665b600", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:2179ddb6-2c64-5f4b-a67c-29c5577567ac", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1b2bbfbe-d77a-596d-a405-2b495db165ca", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:6172d551-407c-510b-af49-bae8d3789499", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:e5dd9599-a2bb-56c3-9ea6-122ff5a59f5e", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c05b52f4-943c-5b90-a607-825f741f2363", "id": "CVE-2026-41847", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:deef37e4-0d95-575d-92ee-b34016a14eac", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:08ca1ba0-b3f8-55fd-9774-d2b94eef3185", "id": "CVE-2026-41849", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-expression. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:972d107d-9b09-572c-b1f4-8aa4246decb0", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5dd2017b-9bd6-56f2-b317-6d2564c8c675", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:f611f662-ef29-50c6-9d5d-85db71b94e85", "id": "CVE-2026-41852", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:66a435a3-8c46-577e-ae7a-24d198ea3b12", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:702e51c6-670c-590d-b42c-fa93577a548a", "id": "CVE-2026-41854", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.11 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ..." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:b88265de-3b29-55e8-b194-bd178e095b7a", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:ebc7ac3d-ec15-5c39-bb6b-78702c3bb647", "id": "CVE-2026-47884", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:58fc8659-ee2b-52b8-b412-c3c76de02d2d", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c23ed2eb-d483-5886-b79c-dda06df3e9e0", "id": "CVE-2026-47887", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:8de689c1-17ef-56f1-a467-7752395298e4", "id": "CVE-2026-47888", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:cd273d01-e080-5873-bda2-2b2fe3899275", "id": "CVE-2026-47891", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c2d3e1a1-f50d-5795-b70d-3631fff62a80", "id": "CVE-2026-47892", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:888582ff-5720-5e41-bf24-f3842433a0da", "id": "CVE-2026-47893", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:59578285-a68e-585b-8462-fb7b21f8fd7f", "id": "CVE-2026-59280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:9d648519-f9f6-5af2-b696-85cf4685ed15", "id": "CVE-2026-59281", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:de489819-20c4-5c29-9f4b-a0e9cc464a81", "id": "CVE-2026-59282", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:5c41286e-a0db-5df5-b5d8-a3a881a642e7", "id": "CVE-2026-59283", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:c792c697-4828-57ef-a64e-9324cb528436", "id": "CVE-2026-59313", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }, { "bom-ref": "urn:uuid:1438eaa1-d34d-5f22-b4a8-d5b9338b5d1f", "id": "CVE-2026-59314", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.11 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.11" } ] }