{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9c8e904f-ddaf-5618-8b80-2e6fee760ad6", "version": 1, "metadata": { "tools": [ { "name": "tuxcare-vex-generator", "version": "1.0.0" } ] }, "components": [ { "bom-ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4", "type": "library", "group": "org.springframework", "name": "spring-expression", "version": "5.1.20.RELEASE-tuxcare.4", "purl": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ], "vulnerabilities": [ { "bom-ref": "urn:uuid:bde34427-6dc7-5119-82fd-be85bb1cca97", "id": "CVE-2016-1000027", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:cc478cfc-f6ef-55c2-822d-af884f3b8ef4", "id": "CVE-2020-5421", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5421 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c197ad6d-4a99-5a04-bf0f-7e4854ce6661", "id": "CVE-2021-22096", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22096 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:50f9469a-8d31-596b-a739-25697ac3af96", "id": "CVE-2021-22118", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22118 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6c357c18-0249-5421-840d-f8aa65ccac7c", "id": "CVE-2022-22950", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:6f7f417c-0d85-5ddd-89e6-ffb2e75dacb9", "id": "CVE-2022-22965", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0e343d96-a189-5afb-b27f-615136c1f374", "id": "CVE-2022-22968", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9e0ce3ae-6c73-5592-b78f-7174ad0d7104", "id": "CVE-2022-22970", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c51cba6c-b646-5d45-bde4-dea6e17f4189", "id": "CVE-2022-22971", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a81278aa-da7a-5f8c-9aee-8a5ac56be7de", "id": "CVE-2023-20861", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:51f69fdc-cc69-588d-aba9-3adfc0955aea", "id": "CVE-2023-20863", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:49b7501d-0e3e-5c46-afdd-d930f08b4ed3", "id": "CVE-2024-22243", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1cc97b77-a5f5-5321-acb5-92459747d1ee", "id": "CVE-2024-22259", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2ab03b30-e608-5cd2-9523-9d6b10086c98", "id": "CVE-2024-22262", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:bb944beb-fc6e-5642-874d-a9fd4dee7aa9", "id": "CVE-2024-38808", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b7ba1325-a28b-5899-abc2-b4e0fe3194f0", "id": "CVE-2024-38809", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2024-38809 is a false positive for org.springframework:spring-expression 5.1.20.RELEASE-tuxcare.4." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:86e14fb1-1a92-5f04-b33f-6d1aff606c4a", "id": "CVE-2024-38819", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ac822f38-0bac-56ec-af4c-48647b962cd8", "id": "CVE-2024-38820", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:36b8da43-7f22-5748-9afd-f8f3e32d0935", "id": "CVE-2025-22233", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1b6cbb3c-c8be-50fb-84e9-cab06c18146b", "id": "CVE-2025-41242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b2f3ab31-1396-50c8-a6cd-ecf73cdeef77", "id": "CVE-2025-41249", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41249 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:78f1831d-ee16-5d76-8145-c7b3b5e594bb", "id": "CVE-2025-41254", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8a18d8c5-8a7a-5bd9-9dc3-e8189316576b", "id": "CVE-2026-22735", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:af0abd89-cd16-5f46-986c-91769ef1e707", "id": "CVE-2026-22737", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:2cbd3426-cb51-5966-a6c1-f239d9df50e4", "id": "CVE-2026-22740", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22740 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:e81ece5c-bf40-518c-a7f5-78491bee12e2", "id": "CVE-2026-22741", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1ccf4a2f-9545-5f82-a297-810e2ff9581c", "id": "CVE-2026-22745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:fb56eba0-e8b9-56e1-9b3f-da545d4c9832", "id": "CVE-2026-41838", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:daaa524e-6aa0-577f-9a9d-328f8529587d", "id": "CVE-2026-41839", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41839 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b394c33b-06b5-53d2-8860-9d57944817e3", "id": "CVE-2026-41840", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 Spring Framework version 5.1.20.RELEASE-tuxcare.2 is NOT affected by CVE-2026-41840. The target predates the vulnerable architecture (PartGenerator/MultipartParser) introduced in Spring 5.3.0 and uses a fundamentally different multipart parsing implementation (Synchronoss NIO Multipart library)." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:f5615b6f-6dce-584d-a012-e60f861bf6ce", "id": "CVE-2026-41841", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:8760b12c-1e0c-508f-8377-913fb7b4e41e", "id": "CVE-2026-41842", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:152995c8-8a67-51f8-b2dd-b9d87b190eb5", "id": "CVE-2026-41843", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:9802bdba-c3fa-5f42-8791-d4a1fe70a3f9", "id": "CVE-2026-41844", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41844 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:5b1fdd60-b990-5180-9b79-715039515f25", "id": "CVE-2026-41845", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:04afae88-4012-555c-bcec-9133f9977ee2", "id": "CVE-2026-41846", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41846 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:415277f8-3738-5233-ad13-367ef28f4183", "id": "CVE-2026-41847", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41847 does not affect version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression. Spring Framework 5.1.20.RELEASE is outside the CVE-2026-41847 affected range of 5.3.0 through 5.3.48 and predates the vulnerable RouterFunctionDsl.filter API." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4ba17b27-4c69-5bcb-acfb-392eb91b6ea9", "id": "CVE-2026-41848", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:1a377d1e-c552-57b0-a110-a5f9c7cd3a15", "id": "CVE-2026-41849", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:17012049-5b98-5b12-9be8-eaac9137330a", "id": "CVE-2026-41850", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41850 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d7ae2801-9c45-51b2-92b7-936919a91b71", "id": "CVE-2026-41851", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:0a8db01c-6800-5aeb-bbdb-72eda6600fb0", "id": "CVE-2026-41852", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41852 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d410dcf8-23ee-502e-97de-38f1f58b9012", "id": "CVE-2026-41853", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 Spring Framework version 5.1.20 is not affected by CVE-2026-41853. The vulnerability affects versions 5.3.0 and later, where a new native multipart parser (DefaultPartHttpMessageReader) was introduced. Version 5.1.20 uses different multipart parsing implementations that do not contain the vulnerable code." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:a78d03ff-b091-50c7-a581-f87e5b0ac2ae", "id": "CVE-2026-41854", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:c03b6c5b-5f8d-5af7-b578-c72c16ed9616", "id": "CVE-2026-41855", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41855 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:b77e5c04-43c2-5a4d-9ffb-2f9638b7e86c", "id": "CVE-2026-47884", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47884 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:d5bb3063-cc99-5633-aa9d-7577db2c7849", "id": "CVE-2026-47886", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4f090427-e318-5550-be56-0c4cf917cf9d", "id": "CVE-2026-47887", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:ec1b0b2c-f9d1-5d2e-bf89-4cc4f19058f8", "id": "CVE-2026-47891", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47891 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:93624d9e-7e41-51e4-8618-a63216cde8d1", "id": "CVE-2026-47893", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47893 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:78289542-23a7-5194-a0d6-840c6d7af7bc", "id": "CVE-2026-59280", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59280 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4f877b7a-7771-519c-8e83-a6e73712e8b6", "id": "CVE-2026-59281", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59281 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:767d0c6c-d705-5467-a023-8e1312f8d496", "id": "CVE-2026-59282", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:89f6fcc2-5230-50c6-804d-9dfc3189d910", "id": "CVE-2026-59283", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }, { "bom-ref": "urn:uuid:4a45db64-bf04-5302-8ef2-f007bbbde26c", "id": "CVE-2026-59314", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 5.1.20.RELEASE-tuxcare.4 of org.springframework:spring-expression." }, "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.1.20.RELEASE-tuxcare.4" } ] }