{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:5cf124b3-2b98-5f6b-b9bf-1482dc60e6cd", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1", "version": "4.3.27.RELEASE-tuxcare.1", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:5542798a-4243-5644-b2c0-9a03676fd0bc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:700c1a4d-2efc-52dd-b644-a0b1299508a6", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:06a6726a-e30a-5b70-af10-ea08807b2e9d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2021-22096 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4eef0f9d-279a-519a-a984-32b98f990d36", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression. Spring Framework 4.3.27.RELEASE is not affected by CVE-2021-22118. The vulnerability exists in WebFlux's reactive multipart handlers (SynchronossPartHttpMessageReader, DefaultPartHttpMessageReader) that use fixed predictable temp directories. Version 4.3.27 predates WebFlux (introduced in Spring 5.0) and uses servlet-based multipart handling via Apache Commons FileUpload with servlet-container-managed directories and random temp file names, eliminating the attack vector.", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8637534b-c19a-5dd1-a17f-107670b40eeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b01813f3-8ff9-5c2b-bc75-5dfa6f98076d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22965 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4a20caa5-457d-5c65-8eab-d62ca5297606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:ac80c660-9830-5ce7-9581-a28402c8d130", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2022-22970 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f281b83c-925f-5137-a1fc-27621082db4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1ab441f-f1ec-57a4-b850-bc7ada02ec0f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:1d048711-e206-5f0d-b233-cfae06b48d23", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-20863 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0ffef713-9a4d-50ec-9767-2955873ca9c0", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22243 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4e422bb0-65f5-5624-b31b-03bb3f16ef71", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:975b146e-1e06-50a5-a902-90370b5fbbde", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b2ce7886-cddb-5ff8-be2b-c26e458f04e2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:255df3ad-9541-5f4d-a1be-d9b904a918af", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:cc8a9863-899a-502c-9352-feef388067dd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:066723ef-81bd-5d75-8b88-2753cb7ffefa", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2024-38820 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 CVE-2024-38820 describes a locale-dependent toLowerCase() vulnerability in DataBinder's disallowedFields pattern matching, introduced by the fix for CVE-2022-22968. Spring Framework 4.3.27.RELEASE is NOT affected because CVE-2022-22968 was never applied to this version. The DataBinder code uses case-SENSITIVE matching without any toLowerCase() calls, so the vulnerable pattern described in the C...", "justification": "code_not_present" } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:fc601a37-b073-569e-b812-2d03978167d5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:63363e76-d06b-5a1f-aaf3-2581806d2324", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c9a6cc70-361b-5ead-937f-637cfa69a0c8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:979f72be-dcb6-57e0-a383-1b0dd8aecc14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bb20bcfd-33f3-52aa-84f9-7638492ec349", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:359ba7a5-1a57-5eda-a6d1-bf1663c1b99a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:b7684819-2964-5fce-aaca-535d5744a8cc", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.3.27.RELEASE is not affected by CVE-2026-22740. The vulnerability is specific to WebFlux reactive multipart handling components (PartGenerator, MultipartHttpMessageReader) that were introduced in Spring Framework 5.0. Version 4.3.27.RELEASE predates WebFlux entirely and uses traditional servlet-based multipart handling with a different cleanup mechanism (finally block in Disp...", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:e2ccec02-d3f6-5079-9590-38b998d9df77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:3327a0d9-5d7f-5929-8bed-9d34f59a1bd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2420a928-d199-5788-952c-10e655dd71eb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2eeb46b8-bdf5-5629-9943-a36c789a9486", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:83fc7ef1-ad95-567c-88c1-7dee0e0e8e47", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d4241538-06ba-57ad-adfe-55c52841750e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:77fca8ac-3c03-5475-87ec-f07327018ece", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:37f16fdc-1a23-5f2d-adc6-f95dff48a5d0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:81764115-8f9d-5bbd-8e50-a5133c24a7ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:2d5ffb25-d26d-5b11-b152-1302b1b4832c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:adba9fb0-501c-5ccc-b855-6624cdc27c6f", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:4ae79d74-097c-59fe-b2e6-028ce9e93575", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:f1cb0381-7d62-522b-9288-3c2ac500efb7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6638ec0d-2d6c-5de0-b87c-03ba5e09d444", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:8c28cb15-7172-57af-9a58-609240158fa5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41853 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:d75c9a11-0a3f-52fa-8ad0-3b65a8856067", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:bee1a9c2-0659-5863-b2bb-2bdc90030bc4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:6477a624-ae8d-519a-911b-0080fd372dcb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:40ddf62c-fd27-518e-9644-bcc1a4b92994", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:50c7556e-c9da-5f9b-87b9-22d1400dee97", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:7191216b-5b04-50a8-b034-05f9596cb01f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:c0019076-662c-5806-990d-cf4e03b3b60e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:9ff3af25-6869-583a-a06d-3dbc3f0559ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:df31f954-874d-55ca-9851-d55b302be86b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ], "bom-ref": "urn:uuid:0908b8be-47ce-586e-a8fb-5710d995027b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 4.3.27.RELEASE-tuxcare.1 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.27.RELEASE-tuxcare.1" } ] }