{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:cdd9d20a-f2af-5e96-9dbf-675775811475", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15", "version": "5.3.31-tuxcare.15", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:cdbb2e3c-8ad0-5e0b-a8fd-bd9baad283ac", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.31-tuxcare.15 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ea1ce8e6-3132-5b12-b698-4ccdaf87c774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ab7d3131-1bde-52ae-827f-02a9d339453f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:09dc1d3a-e12e-50ba-b8ff-19ace1482338", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:587f6810-d4a2-50a2-8676-a561187bc732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a0fe6414-c3f7-54a4-bd5f-c3edfb3fb335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8aaa6451-a69e-56d2-9e5b-90d54c7d9f9e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e46fe80a-18c4-50cc-94b4-194c7d716431", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:efc260c0-8529-5a82-b903-c6f3c3608f6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f3de8635-9238-5c31-893d-1bbd305d54c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4f6b904b-2b94-5036-92ec-6c0e65b760b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:073a5259-4fba-56a6-8824-69e161050225", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-expression 5.3.31-tuxcare.15." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:6a1b2547-14b7-56a8-8f8f-223ff53cb49e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f1bd98f3-04c7-56ea-8281-fa6db9416d3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:585d8cb7-da70-58ed-9cae-45dba0d0df0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:36289a6f-9e44-5995-81f2-02be1c0c7278", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:bbc539bb-7da4-534f-ac52-74459b81577a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:153e232c-1ee2-544a-94fa-105f0cd955b7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:87c2b107-9091-56c5-9579-53d7dc6bed11", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f880c955-b884-5a44-a67c-9110c7cfeadc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:53ebc8b7-6093-5937-a578-6569e9667098", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:c437798d-cd74-5aab-9732-77b7cadb3014", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d8b7943b-9eb6-52b4-9f0b-879a66f9f247", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.31-tuxcare.15 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.31-tuxcare.3) already contains the complete fix for CVE-2026-41840. Both required doOnDiscard handlers were applied via commit 615477c88f (labeled as CVE-2026-22740 backport) merged on May 4, 2026. The code changes are byte-for-byte identical to the upstream patches.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:08d5ef63-ca60-5d1b-bd81-6fb2a677b5e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8f87db4e-d51f-5fdd-82b1-ca68d0a2b963", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:e15cabf2-9e46-5f73-9593-ca74096cdad0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2e18cd98-d512-5ad2-88f5-7c9a2dc11a3e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:bf34b82f-7cc1-5c4b-ac7e-0178f7789d86", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ce7be738-24a3-5edc-b469-6b5799609497", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:0ceb89ef-6864-558a-a8aa-f6739b05f986", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:7170fbb9-bbd6-5b19-984d-17ac02da638e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f6c01b72-e4cd-56c6-a06b-77dde0579202", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a1ce383a-2847-5f24-9f82-110e3d725c1c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:3fface32-6101-55d4-989a-49eeadbfa96b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:934d2ec6-ace9-5307-80dc-56480c3b1748", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:f2e3d687-37bd-53d6-9fc2-d50546a82b41", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:467d16f1-9761-5396-a2d3-90eff3426562", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:a8a5584b-34d6-55d4-89ec-b33c321136e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2aca2f6b-bdd7-5cbb-8606-8d4644778ca8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:71dd80ca-ffd0-5c3e-a2c7-e044f2826b82", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:ed60cda6-61db-5806-b64c-92053f5166dc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:780bf134-747d-5a90-ab2d-0725da05b546", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:af362a7e-d2dc-5e32-bcbc-4f3638634237", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:2bde08f8-a16f-5226-bf85-054da2eaf4a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:eecdf5b0-fdb9-5bb9-b91a-c11cef0e972c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4942eb53-62d1-52fb-8259-14623232a7f7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:cf9774e9-e05c-55b9-b5c4-c3450148552f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:d1b1718c-dbeb-5fef-b04e-7efc63a0563c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:8e9053d6-64b0-5572-8a91-5fdf8622bd6a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:4d785569-9b03-5ea8-836a-ad5c79794617", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ], "bom-ref": "urn:uuid:99458707-4796-5f04-b205-76a90088aa37", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.31-tuxcare.15 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.31-tuxcare.15" } ] }