{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:549ab2a9-4d54-5f38-a0a5-2e630a229e5a", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:31c67204-5059-5a73-bb02-0990de10a39e", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 affects Spring Framework versions 5.3.0-5.3.16 and 5.2.0-5.2.19 through unbounded array allocation in SpEL expressions causing DoS. The target version 6.0.11 is NOT vulnerable. The fix (MAX_ARRAY_ELEMENTS validation limiting arrays to 256K elements) was already present in upstream Spring Framework 6.0.11 when TuxCare onboarded this version. Fix commit 83ac65915871067c39a4fb255e0d...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:75f4c522-36ea-5559-baf5-a03671aff103", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 is not present in the target. The vulnerability concerns repeated compilation of regex patterns in SpEL matches operations causing DoS. The fix (shared pattern cache across all matches operations) was already included in upstream Spring Framework 6.0.11, which TuxCare onboarded without modification. Commit 935c29e3ddba5b19951e54f6685c70ed45d9cbe5 by Sam Brannen introduced the fix...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b345182c-fa82-589f-800c-98d46683bd30", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 does not affect Spring Framework 6.0.11. The vulnerability allows DoS via extremely long SpEL expressions, but the fix was already present in upstream v6.0.8 (released April 2023). Target version 6.0.11 (released July 2023) includes the upstream fix that limits SpEL expression length to 10,000 characters by default, preventing resource exhaustion attacks. The vulnerable code patt...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a20a259b-f2bc-58a5-b30e-42c78c9bb270", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression, and is fixed in 6.0.11-tuxcare.7." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f1e92136-77cf-5967-a72c-c150a87d4417", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-expression. Version 6.0.11 is on a newer release line than any version the advisories list as affected. Advisories: GitHub GHSA-775g-4xr8-78h8 (affected up to 5.3.39), NVD (affected below 5.3.49), CVE record (affected below 5.3.49), Snyk (affected below 6.0.0).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1ee07535-1b4f-5ed1-be28-31ebc33a4cb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ecaa54ec-56f5-5a11-bc29-64e74fe51a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d8f26a7f-33ce-5a91-bb54-d40e0eff1ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a43e966e-2bcd-5361-98ed-74759fe144fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d89c80e5-a63f-5c81-9607-3563894d9474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ] }