{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:372c4d7b-af32-53f5-b388-b8df5c84584e",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-expression",
      "purl": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6",
      "version": "6.0.12-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-expression",
            "purl": "pkg:maven/org.springframework/spring-expression@6.0.12",
            "type": "library",
            "group": "org.springframework",
            "version": "6.0.12"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2009-1190",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:272a1ab9-ce9b-5260-b6dd-45767c54c933",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2009-1190 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2011-2730",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:775a0007-3e60-5d32-b8de-6e16568b7e39",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2730 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2011-2894",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4b93582c-6a1a-592f-9e1c-7250ff851992",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2011-2894 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2014-3578",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:b95b3d18-f51f-5560-9b51-eaac85a5bd35",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2014-3578 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2015-0201",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:02d3edfd-6fce-5e3a-a5be-880d98b2a1d1",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-0201 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2015-5211",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:218d369b-62a6-51ed-a399-cc8e7528ebc2",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2015-5211 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2016-5007",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:92fed496-f668-52c3-9366-c1eaa546c95f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-5007 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-11040",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2a160ae1-ff6e-58c3-a3f6-d0e18c8234e0",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-11040 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1199",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:fde69e3e-b607-5d82-bd5c-673a1907915f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1199 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1257",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:2ba86390-7ab6-5002-9c17-78c6b83cd01f",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2018-1257 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework v6.0.12 is not affected by CVE-2018-1257. The vulnerability affected versions prior to 4.3.17 and 5.0.6, which lacked the ability to disable the SpEL-based selector feature in STOMP messaging. The fix (commit ff2228fdaf131d57b5c8c5918ee8d07c6dd9bbac, April 2018 by Rossen Stoyanchev) added a null check and the ability to set selectorHeaderName to null to disable selector parsing...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2018-1258",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e2924886-4c4c-5076-b8d7-0676c412c3d4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1258 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1271",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:5c046464-851b-502e-9342-97ae1748ba1b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1271 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-1272",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:42aa5c59-78ea-5cce-a828-776c0a2e3906",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-1272 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2018-15756",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:ffa08618-f60c-510a-9d26-85e26eecffc6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2018-15756 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:776a4618-60bb-59d9-814c-d7f361d1d307",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22060 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2021-22096",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:a357a70a-cf87-546f-8e86-bb74f50d07e6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2021-22096 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d0063386-3809-51e5-b0cf-a1d755f04752",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:8e6f36b7-a5b1-57c4-ad04-1a361204bd5d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20861 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:86c4897f-95f5-5b6b-8345-625063069c93",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2023-20863 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:99138c57-1ea8-5ec3-be77-4466aecb3e82",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7ffa5271-7dfb-52f2-bcd1-090e632b126d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-38808 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:0be9cc02-1c42-5bfc-b302-c20172773a03",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:1bf52157-d538-57e8-aea9-898b38a402f6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:c1af6596-b009-5023-ba00-3c2600b3cb05",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6d4be059-56c6-521e-a4f8-39caa7c7b687",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:23286f4b-1416-5314-a0a2-c6097138bf7a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:e19695dd-b22c-50cc-80b4-6e92d784e745",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7d6f6335-599f-5195-a14b-eb86690c2588",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3481d61d-cc2d-5d2e-a60f-63eb6ceedaeb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6"
    }
  ]
}