{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5dcf5675-95f9-523c-b8dd-5c799b0cf3c4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5", "version": "6.0.12-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2009-1190", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:24cb448c-7e4a-5b06-94a6-da6f6d0c1348", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2730", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:9ce14d87-177d-5bff-8a07-47c2a193c9d3", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2011-2894", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:c8976e8c-5f4e-54be-a9a8-37d9a038a7ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2014-3578", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:2fad23f4-b247-56b2-9226-50eefeb725e5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-0201", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:7a0482b7-b3e6-5b88-86b6-c379fa75d5f8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2015-5211", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:280ff223-7d0c-5d25-ac06-4640429067f1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2016-5007", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:054f0915-ac9a-5666-9f72-f1b85b3173a9", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-11040", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:eb8aa71f-f5e7-5ef8-91a9-d3e6b1cf87d6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1199", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:24bf7e4b-7a1e-5fbf-a87c-16e53cd41169", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1257", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:5553ee94-97ce-5d24-8790-52a4d192ddd4", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...", "justification": "code_not_present" } }, { "id": "CVE-2018-1258", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:57695dbc-7b02-5b17-82a8-6af928698b10", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1271", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:79cef56b-ed10-5de6-8715-db579ad2b518", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-1272", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:990e5d38-5ebc-5d87-bc8f-98814b4b1bf5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2018-15756", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:8256a51d-421f-58eb-bb2f-bcbd5c940ab5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:13bc3932-acd1-5d0b-a932-3021971ba902", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0c6e7a8b-b1b8-57d5-9817-510ca751fff0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:49238ab3-811f-52e9-8b7c-1d1d8cb85f91", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22950 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:12bfd504-b30f-5962-a9ae-7c34ca6815a1", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:2d35bbe2-40cc-5a81-b69f-907b455fe431", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:e0b68a11-be41-59e7-86db-040fea266c57", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:a9bb9ec3-3287-5ef0-b3ea-e1849dd94f02", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3a75f92a-e21f-526b-9aed-db65d5896a89", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:8b827494-cabf-5b8d-ae14-cf8cd369835c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:496d5175-56c0-539d-b288-cffc007e04cd", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:3a03c7ae-b98b-5bc3-ba4b-3516d771e50a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0b2a1442-d100-5002-8f01-8d11e1e69a42", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 6.0.12-tuxcare.5 of org.springframework:spring-expression, and is fixed in 6.0.12-tuxcare.6." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:ea5f1de0-a76f-5709-b533-bdc48538b4df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:8776f9b9-a6cd-5d43-9ed6-0ad28f5506e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ], "bom-ref": "urn:uuid:0a5a1275-69d5-5d07-bab7-5d34fda0dcad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.5 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.5" } ] }