{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:b3752b70-ae8a-5cf9-ba89-3f4fb5bde35d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-expression",
      "purl": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1",
      "version": "5.3.5-tuxcare.1",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-expression",
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.5",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.5"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1705ee55-805f-5a5e-a93a-45b847c57150",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:82a32207-9d7e-5c81-948e-6386b0df58fa",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9df0ccf3-e4d6-55c8-95fb-950c544b1a6a",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:05f1325c-1be1-5cde-8088-8824dba2f235",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:2d94f5e4-99d8-595c-a3f9-f72d870cdddf",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:5827d628-685a-58d7-b58e-39cd43b1a1a1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:80ebff5e-cac2-524a-a913-4b77a88ff90f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:60bc0c3e-ab4a-549e-bd62-745521ea3b0e",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:4d09f2ba-d2e0-599c-ad0e-9a9a229a69d8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f07dba2d-e4cb-5305-b191-fac01f0ae38a",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 5.3.5-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2018-1257 is NOT present in Spring Framework 5.3.5. The vulnerability involved unguarded Spring EL expression parsing of user-controlled selector headers in STOMP messaging, which could lead to ReDoS attacks. The upstream fix (adding null-check guards and the ability to disable the selector feature) was applied in April 2018 and shipped in the upstream Spring Framework 5.3.5 release that Tu...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:18e966bd-c1a1-517d-acef-cfb89f06f624",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:95893ed1-bc5f-5dcb-88e4-d81abefbcf4c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9b897755-a106-5cd6-a27c-ec0ee57d51f8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:59f8af9d-d8be-5a80-b7a9-f03ae6e99728",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:53a5b8e4-66ab-5f10-a33d-e321a9bb3198",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:68ddb852-5ec9-5f8e-a1bb-5a0770eed83c",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:1f95ba3a-c864-51aa-b5a0-c5fa1b3f22b2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:6b3048d3-c390-5e67-8726-e470370f40e4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:c0aaf9c8-c9d6-512c-9805-36eb53904dde",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:14b01343-9bdf-52f4-9fbb-823c56717603",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:9e5bba23-49e7-5fdf-bd18-3da72e3907ab",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:f4771e73-e730-5657-aad4-5abb229d2f61",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41249 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:0e8dcf88-268b-5db5-af59-fe83b7317224",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:3b6054b6-f868-5e80-9f7a-105082075673",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:002db7fa-bd8d-5b74-8024-d543a3b5b454",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:355d5f29-f362-57f9-bf90-cb584db35c36",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:ab4d3e32-c255-5da5-8834-21721581cc60",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:a0a72b41-350e-55c5-8539-f10ac84d6976",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
        }
      ],
      "bom-ref": "urn:uuid:98c626a7-9c63-55b0-b08d-1a0c74b25791",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.5-tuxcare.1 of org.springframework:spring-expression."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@5.3.5-tuxcare.1"
    }
  ]
}