{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:acf41dbf-fd69-5abd-aa00-4b3c34594255", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6", "type": "library", "group": "org.springframework", "name": "spring-expression", "version": "5.3.27-tuxcare.6", "purl": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:e21f6d8f-8d6d-5129-a464-22b981453a5a", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:949e4615-05a8-5e35-94e3-3e39f7973b8d", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:729e884e-28d1-501a-a8ac-50ea0782d78e", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:1e1f2f23-9d2a-5048-9bac-bad7709413be", "id": "CVE-2024-22262", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:52be7ae1-11a7-5478-b8fb-26f098def4fe", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:94523d05-d37d-522c-a635-19b72514290e", "id": "CVE-2024-38809", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3602a2b0-f70d-5f1c-87c4-3f7ccced20c2", "id": "CVE-2024-38816", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:663af742-e774-52e4-8f45-b33d12c0dd45", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:09b721b5-cca8-5988-aa86-3975fdf51613", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b56fa8c2-5a46-539c-8faa-2547d1f527d5", "id": "CVE-2024-38828", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:81e24ebd-4cc5-5c6c-b16b-09156bbf3844", "id": "CVE-2025-22233", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c8d9a177-3a16-56b1-b039-1b3b3747f028", "id": "CVE-2025-41234", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-expression 5.3.27-tuxcare.6." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:cd757b92-b2a7-516f-93ac-b7c5b648f752", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2c1154da-873a-522b-bba4-aa25bd117aff", "id": "CVE-2025-41249", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9d4e5f89-ed49-5e4f-a4ee-f0c49dc968a9", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d5e3d61e-482b-5e39-932b-78e814ed49b3", "id": "CVE-2026-22735", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:3929d36e-ee4d-54d7-8b85-96d4b88b00df", "id": "CVE-2026-22737", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c362f97a-9c41-5509-a984-9e0dbef47808", "id": "CVE-2026-22740", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:fc23c7d8-ce4b-5b27-8e42-38d441de8546", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b4788b3b-bf84-5fd2-8c8b-84d346d7c4d6", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b898717f-8198-54a2-a6dc-11ae1dbd5e1b", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:2e49c068-a18f-56ca-82c4-5ce6fde72b12", "id": "CVE-2026-41839", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:40bcf456-5c13-5988-a387-052149de5577", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.27-tuxcare.5) already contains the fix for CVE-2026-41840. The vulnerability was previously addressed through backport commits for CVE-2026-22740, which applied the identical doOnDiscard cleanup logic to prevent resource exhaustion from multipart request processing." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:113aa31e-91a3-5922-aa92-b366849011ce", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:b7e8a3b2-3806-5e38-b402-9971a89d45af", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:860af54b-78bb-56a3-83f1-166226cc7566", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:feead5f4-62b8-5627-bedd-87a294aab2c8", "id": "CVE-2026-41844", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4c6aac20-0185-5f96-bb85-f332f8d50f4a", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:87752bcf-bffd-5f7c-9bd1-9404d651fedd", "id": "CVE-2026-41846", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:4120d766-3b4b-57ed-9206-3855d6e3cdda", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.3.27-tuxcare.6 of org.springframework:spring-expression. All 1 patch commits already exist in target branch" }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:9ef93efa-ba40-59e7-8438-c6a31d10c999", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:5226d40c-7ee1-5d35-9918-573bf0e4de68", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:53034c29-b4a9-52a9-88ba-97a3702014cb", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:c4a27526-3461-5b34-9a44-11026bc15300", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:e1157c23-5c78-5ac0-b418-26b9407f5a16", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:433cb782-fe6a-582e-a1f4-214fd765e11c", "id": "CVE-2026-41853", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }, { "bom-ref": "urn:uuid:d44dc10a-b383-50cc-9237-221e50501824", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.3.27-tuxcare.6 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.27-tuxcare.6" } ] }