{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:af7a8541-9a12-5d89-aabb-e4ddf434e2fc", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5", "type": "library", "group": "org.springframework", "name": "spring-expression", "version": "4.2.9.RELEASE-tuxcare.5", "purl": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:f9552b7b-fcbf-5690-bb03-50dd554e1d55", "id": "CVE-2016-1000027", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-1000027 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:726702f1-fc9a-5072-9133-14b42980903e", "id": "CVE-2016-5007", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2016-5007 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:ef9fa0f0-982a-5409-978b-f5525af9f0c0", "id": "CVE-2016-9878", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2016-9878 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression. already_fixed \u2014 The target Spring Framework 4.2.9.RELEASE already contains the fix for CVE-2016-9878. The vulnerable path traversal issue in ResourceServlet.doInclude() has been mitigated by adding StringUtils.cleanPath() to normalize resource URLs before processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:71b215a3-9305-5d0e-866b-05a6ae38a8c2", "id": "CVE-2018-1257", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1257 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e7be029c-5307-58a8-b750-34434c8eb822", "id": "CVE-2018-1270", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1270 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cfb7afd4-5a20-58a5-a50f-5aaa2a9c1b4d", "id": "CVE-2018-1271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1271 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:4515f9cf-7471-52c9-9b34-ef2be04cce50", "id": "CVE-2018-1272", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1272 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e68bc581-2648-57de-93e8-486b89663cb7", "id": "CVE-2018-1275", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-1275 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cec954df-2acb-5d34-890d-96cddfd076b0", "id": "CVE-2018-15756", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2018-15756 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:21382b1b-08e6-5c18-aaa7-5f71f36bc415", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:73f601ba-1233-572f-b923-bb594fbe4028", "id": "CVE-2021-22096", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2d8f7540-595a-5d18-bb42-784358cf049c", "id": "CVE-2021-22118", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22118 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0ac69bd7-7e29-5798-ac21-67503db0d542", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:5358eefc-3aa3-5c60-852c-d20986fc11d5", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:df68ad2a-4530-56fb-978e-d1687b764510", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3e99b0a9-a41b-58cf-8b9b-14fd27bf6e81", "id": "CVE-2022-22970", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0dfe9648-1b57-5339-9bc0-d30cc9ef7161", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0e8b50d7-dfe1-5110-8890-f8837f9d70e2", "id": "CVE-2023-20861", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20861 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:a4e419cb-301a-5336-bdd2-554bbe0d6a9b", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:f19e5db1-d5b4-58c9-92e4-6e2992d80eb8", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b651f735-2741-519b-8416-c4328e9d68ce", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:bd874169-170f-5ee1-beff-559eccc39bd3", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:c2baae7c-c051-5ff9-b6eb-a6865e4a0ed2", "id": "CVE-2024-38808", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:572e46f8-cb47-5e09-b753-0884edb4f3d3", "id": "CVE-2024-38809", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38809 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression. No ReDoS vulnerability: ETAG_HEADER_VALUE_PATTERN regex is not used in this version (introduced in 4.3.30)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:88a7492e-a44f-50c0-81c9-13e396b925ba", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:e7747ab1-de25-54fb-b2d5-7443a225e316", "id": "CVE-2024-38820", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:35f8bc74-835a-565b-bd6b-58e59fb0d26e", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3563547b-ee74-57f5-81c9-1f9251fbe012", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:cee545b3-bbad-51f8-83ba-d4565b027100", "id": "CVE-2025-41254", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:31837b30-0517-5d89-acfe-e88b90bd5b55", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:3fd17341-27f5-5cdf-971b-a6e437b03d6a", "id": "CVE-2026-22741", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22741 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:87a3a81f-9fba-5bd0-b468-7be734b09545", "id": "CVE-2026-22745", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22745 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:172ab8a5-05b3-5838-ad03-faccb3fbeaa6", "id": "CVE-2026-41838", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41838 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:1fdbe968-bc72-5f7b-b7df-85706d477191", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2ac0d4fa-12b6-5f32-9c29-6c03bd075cad", "id": "CVE-2026-41842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0c0fa9af-d40d-5751-92d9-2ad97a1f2b0f", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:77ad1f62-8d64-56aa-a6ce-6db73bb49882", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b11d5bae-4398-5298-b234-242ce3b536ca", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:84a8f4cf-debd-55ff-989e-bf116fcb6e62", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:fe2e8788-1f2f-5045-be03-8e24436c3f17", "id": "CVE-2026-41848", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:7c58e9bd-2cbb-5a2f-8aa5-e95a7cee9794", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:2430101d-d5c4-5586-ad30-d77b20f48556", "id": "CVE-2026-41850", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:d26323c0-0253-58da-8bf8-d1d0348205d3", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:0a77d4d4-cc7e-58ae-9d44-59311f714fbf", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:b8c7afe0-72fe-525a-a964-0182fc0088d5", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.2.9.RELEASE-tuxcare.3 is NOT AFFECTED by CVE-2026-41853. While the target version does process multipart requests, the specific vulnerable code path that enables multipart request smuggling appears to be tied to architectural changes introduced in Spring Framework 5.3.0+. The target version (4.2.9) predates these changes and uses a fundamentally different architecture." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }, { "bom-ref": "urn:uuid:112c8772-b2a2-5837-afa0-7b917b446673", "id": "CVE-2026-41855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.2.9.RELEASE-tuxcare.5 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.2.9.RELEASE-tuxcare.5" } ] }