{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:2f03873e-0611-54c5-a43a-8518335ee940", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5", "version": "6.2.3-tuxcare.5", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.2.3", "type": "library", "group": "org.springframework", "version": "6.2.3" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:477b1874-9e15-58bf-8267-cd1072a4d76c", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 6.2.3-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 CVE-2022-22950 is NOT present in Spring Framework 6.2.3. The upstream fix (commit 83ac659 by Sam Brannen) that adds MAX_ARRAY_ELEMENTS validation to prevent DoS via large SpEL array allocations was already included in the upstream 6.2.3 release. The fix predates the first TuxCare commit on this branch, meaning it shipped with the original upstream version that TuxCare onboarded. The vulnerable ...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:7939fa2c-0b7a-5ac1-b49f-07648a5e996b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 6.2.3-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.2.3 is NOT affected by CVE-2023-20861. The vulnerability (inefficient regex pattern caching in SpEL matches operator leading to DoS) was fixed by upstream commit 935c29e3dd on 2023-03-17, authored by sam@sambrannen.com. This fix shipped in the upstream Spring Framework 6.2.3 release before TuxCare began maintaining this version (first TuxCare commit cbda719a7f on 2026-09-01)....", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:71a9a7b6-c9d5-5c53-bce1-8ab4284dfbff", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 6.2.3-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 (SpEL DoS via excessively long expressions) is NOT present in Spring Framework 6.2.3. The upstream fix (commit b73f5fcac22555f844cf27a7eeb876cb9d7f7f7e by Sam Brannen) was already included in the Spring Framework 6.2.3 release that TuxCare onboarded. The fix adds checkExpressionLength() validation that rejects expressions exceeding 10,000 characters before parsing begins, prevent...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:aabd1ca7-b82a-507c-bb6f-efe44436b895", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38808 does not affect version 6.2.3-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 6.2.3 is not affected by CVE-2024-38808. The vulnerability concerns DoS via specially crafted SpEL expressions in versions 5.3.0-5.3.38, but the target version 6.2.3 already contains upstream fixes for both vulnerability patterns: (1) assignment bypass in read-only contexts (commit 0127de5a7a by Sam Brannen) and (2) array construction without constructor resolver (commit a3a48a...", "justification": "code_not_present" } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:fa58e5f9-4105-54cb-97b3-1826643d2000", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 6.2.3-tuxcare.5 of org.springframework:spring-expression. Spring Framework 6.2.3 builds repeated text with the JDK's String.repeat. If the int size check in OpMultiply overflows, String.repeat rejects the request with an OutOfMemoryError before allocating any memory, so the CVE-2026-41849 denial of service cannot occur. The vendor lists only 5.3.x as affected.", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:3bc11724-93e5-5bd1-997b-bbd1b1cd6f81", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.2.3-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:ed42b7d8-cfaa-59dc-b56b-a47ac7c1c27a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.2.3-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:2f0ed4b4-7884-57aa-818d-ec2a8c92e294", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.2.3-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:9a1d9953-3c4c-5aed-a05d-093ee805b1c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.2.3-tuxcare.5 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ], "bom-ref": "urn:uuid:615db3c8-496b-5966-b35a-d84c949ff743", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.2.3-tuxcare.5 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.2.3-tuxcare.5" } ] }