{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:eb28740b-731a-5299-8a85-fe9af7afc5f2",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-expression",
      "purl": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2",
      "version": "5.3.13-tuxcare.2",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-expression",
            "purl": "pkg:maven/org.springframework/spring-expression@5.3.13",
            "type": "library",
            "group": "org.springframework",
            "version": "5.3.13"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2016-1000027",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1c4c28c0-ac5f-589b-b6fe-487c7f99869d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required",
        "response": [
          "will_not_fix"
        ]
      }
    },
    {
      "id": "CVE-2021-22060",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:8f1141c0-3c9a-5797-aba1-6c459f208baf",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2021-22060 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3ef301b6-3d9d-5db7-a4f2-e44dfdbe1a37",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22950 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22965",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:50d7892b-bcdc-560a-9b2b-cf500a8643f3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22965 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22968",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3f2e84c7-3501-5810-a598-c40f81cb2a59",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22968 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22970",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:d3e84235-6fcd-52d2-aa84-797045047420",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2022-22970 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2022-22971",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c784a72b-07b2-59e9-bb2c-720bb24cf3f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22971 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20860",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4a2719e5-213d-57ea-b5be-aadc3da68ec2",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20860 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:18ca392c-2a43-56ae-922e-21440821bb04",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20861 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4b25c83c-37d3-538e-afe1-eadc2192d693",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-22243",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b6a9f69b-f235-50d1-9742-1fb856bd2586",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-22259",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c79a76a5-6346-55de-8876-059b55570525",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22259 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-22262",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4ab12c41-e57d-5115-9793-7d16453cf757",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2024-22262 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:303de662-231d-5739-b5fb-e05108c6e771",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38809",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c2989202-5ee2-5fb3-bab9-bd75824efb98",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38816",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b85895ab-ec92-50c7-8264-3ef51bb1b079",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38819",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:999d9919-66d0-5062-a9da-de2cb9c8f69a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38820",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b0c05d23-16c7-5a8d-8002-38411f086b7e",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38820 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Version 5.3.13 is not affected by CVE-2024-38820. This CVE addresses a locale-dependent toLowerCase() bug in DataBinder's field matching, but version 5.3.13 does not contain the vulnerable code pattern. The CVE-2022-22968 fix (which introduced case-insensitive field matching using toLowerCase()) was never applied to this version, so the locale-dependency issue that CVE-2024-38820 fixes cannot e...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2024-38828",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0c420875-92db-57db-b864-8f2b506fe9c1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2024-38828 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.13 is NOT affected by CVE-2024-38828. The vulnerability was introduced by an optimization commit (gh-31834, 0970b1dc7a) on December 13, 2023, which post-dates version 5.3.13 (released November 11, 2021) by over 2 years. Version 5.3.13 properly allocates ContentCachingRequestWrapper's buffer using the contentCacheLimit parameter, never reading request.getContentLength() when...",
        "justification": "code_not_reachable"
      }
    },
    {
      "id": "CVE-2025-22233",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:cc7f65bb-31fe-530a-97b8-d29b892ae961",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-22233 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2025-41242",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3a47d5ce-b2f6-50ac-a86c-b6788805ee55",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2025-41249",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4ada534a-b499-542d-9c76-69f35881922f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2025-41254",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:628b7961-3d22-5ae7-b272-95544e803f1b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2025-41254 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-22735",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:0b95ff2d-842e-5408-8fbe-06081207e2d1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-22737",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:37924f7a-478b-5433-a0e5-0647f0a7ea8a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-22740",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6a3648eb-dc54-5912-b750-11603a45f8f5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-22741",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:16e29cab-aac8-5a7e-a5d6-45b5174e4dfb",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-22745",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:2ccb6d8e-3e02-53e3-bce8-787380834815",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41838",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e51d9e39-95f3-5e76-aa90-eea771486992",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41838 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41839",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b2888eb3-93de-5b2a-acac-7fa630c03eba",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41840",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:761480d2-e9ad-50e3-befc-048ef1222a84",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41840 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41841",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e1e58e79-00bb-56b9-9bd6-f966135c7391",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41842",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7c54ffad-0f3f-59aa-afe0-6e9841d0c0f1",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41843",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:20ac4362-0b27-548c-a82f-ef52292e088f",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41843 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41844",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ad4beade-7ef7-57c4-aa56-7769e3955ba6",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41844 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41845",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:953ff5f6-74e4-5b32-9190-13287ea15c49",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41846",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:e7f3ebce-600f-5af7-adc8-c17bca14c83b",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41846 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41847",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4c741f99-78a4-56b2-93ee-5909f5a0ed9d",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41847 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41848",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:89fc0d39-ff4d-54c0-9b0f-bf097310d2c4",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41848 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1ea37e79-60d0-5bdb-b4f0-11ec6d7919f5",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41849 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6804975d-4821-505f-9d91-1c165a61b769",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:aafda581-4f85-595b-a644-84d9e8b7f298",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41851 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:b2e6713d-e1bf-5fa9-b877-dbc5859c5f91",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41852 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41853",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:20488615-1a97-5767-a25f-51654c4b2fe3",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41853 affects version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41854",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7c695065-d78d-5378-9e66-c6db93e21c82",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41855",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:4df8b530-9043-539c-965a-58521333c0e6",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47884",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:65186f71-3c7e-51be-b1a8-3ffef61ff02f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:913882bf-56a2-5be7-ab66-9857a5539027",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47887",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:6dd03833-c082-57fd-97cb-288fefc1baa3",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47888",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ee492363-849e-561d-8008-ad25da46fdf0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47890",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:1a5854be-b9c4-5652-bf7e-8d86dc9d8120",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-47890 does not affect version 5.3.13-tuxcare.2 of org.springframework:spring-expression. Target version 5.3.13 is not affected by CVE-2026-47890. The vulnerability requires SSE (Server-Sent Events) Fragment streaming functionality, which was introduced in Spring Framework 6.2.0 (August 2024). Version 5.3.13 predates this feature entirely - the vulnerable code path does not exist. The CVE affects versions 6.2.0-6.2.19 and 7.0.0-7.0.8, all of which postdate the target version.",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-47891",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:905bbc05-30ea-5ea7-8a7b-e713babc5d7a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47892",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:76073726-e003-55f5-a558-7b38f5987fed",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47893",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:ccee813c-6b54-55ef-adea-8db423eb6083",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59280",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:c6d017b8-bf33-5d8f-8e36-5f5e5180dbd0",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59281",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:3ee4cd5e-4c63-58aa-b18a-3078e0be56f4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59282",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7d685166-11c6-55c1-919d-37fc3d4c229f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:80c6d479-b95c-526f-9c59-8f0ae722412a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59313",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:7463e80a-3769-5312-83c5-967c37ed037b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59314",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
        }
      ],
      "bom-ref": "urn:uuid:787d238b-3e1c-5b12-9022-aa8ff98e94e8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.13-tuxcare.2 of org.springframework:spring-expression."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@5.3.13-tuxcare.2"
    }
  ]
}