{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:e55f754e-392b-5fee-90b4-c13292c89005", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6", "version": "6.0.11-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.11", "type": "library", "group": "org.springframework", "version": "6.0.11" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:315cda6c-0edd-5e4a-a71a-0f81803bd960", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4b548a5d-c90b-5b22-b149-7a4a0b1a65ea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:115701d8-fedf-5dec-9453-3a67a783d097", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:de84b5b6-4a14-52bc-98a5-95d1415fbf1b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:aa504582-6e56-55c1-90cb-f6cb0a9ede0c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:7b5c1ce4-67f3-5c81-8934-e6e49278a020", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b8eba619-cc39-5cf2-b2e3-0b8f5a949787", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:29b4baa0-1dbb-593e-947f-2bb19cefe5e4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a9a95671-c21f-5f1a-a225-98c23886cbd5", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:324ec448-718e-5a0a-a126-6e71ae9dd5ec", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:dbbf7626-3275-530d-830a-73ca2b55f018", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:847747fb-7328-572d-83fa-e68de2bf4de5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8db94ed9-6545-5cdb-986e-8eed1e1b758a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:22dde05b-df45-5c62-b8d4-477ac3223cb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:afc6bd0b-54d1-5917-8b5c-e55d3a13cf5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8461517c-5dc5-513d-979c-bda4b0546d95", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a01c07ff-27b0-5863-8ee6-686484ac3878", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:c2bfa6c4-fcb0-5ac6-9440-7e9b44b3ab9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:35874f71-5f3a-5fb9-8b8e-2f7b44fa0c5e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ace072c4-b54c-58a2-9c46-4803fbab8ba9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:13d91018-9728-53b6-9d98-e4d8d0a5812c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d1ca02a1-e307-5c19-b803-e9453cac5774", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:56f73417-5945-5e2c-b0b2-9a8e556407dc", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:39a71134-4cd4-5a6b-b6fc-36454526974e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ba9267fd-59a2-5380-81eb-b0cb355c8b09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6e34f718-eef9-5c05-9653-ad38b11f6557", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:0ac1b20f-7879-57b3-94d5-f0127d37c825", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b5276592-0c07-5c1e-a335-f557cd01e79f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1ee07535-1b4f-5ed1-be28-31ebc33a4cb0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:ecaa54ec-56f5-5a11-bc29-64e74fe51a9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d8f26a7f-33ce-5a91-bb54-d40e0eff1ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:8112bdda-d25f-5ea6-9eee-454bcdec374b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:95d3e886-84df-5f04-b9e4-6d4b083acc91", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:07754d45-82ef-5742-bc21-88c09c3d6525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:6c3a4c8e-4443-5ea9-8b0f-e14bcbc082e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:a43e966e-2bcd-5361-98ed-74759fe144fc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:4e79c471-1e59-5e6f-a569-1e993e287d6b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5f9dddcc-9b33-5515-9b76-ae1ac2ac0f75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:824c3abd-2373-5256-b3d5-d9524d0da6c2", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.11-tuxcare.6 of org.springframework:spring-expression. Spring Framework 6.0.11 is not affected by CVE-2026-47890. The vulnerable SSE (Server-Sent Events) view fragment rendering feature was introduced in version 6.2.0-M7, which postdates the target version 6.0.11. The Fragment class and related SSE fragment escaping code do not exist in this version, making the vulnerability impossible to manifest.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:2d83db8a-41f0-5863-b2ed-1a2685de159e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:5c8de6fc-be0e-5652-bcdf-a137667a3795", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:b673cbda-c90b-57ed-9063-ebbc6d77711c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:1437a4a6-d312-5223-83f8-6c27ced6f9d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:281d60ae-3242-5646-a1fe-f16e54bd9fcd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f7987e7c-ba37-58db-a80a-0aade28d6ba6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:d89c80e5-a63f-5c81-9607-3563894d9474", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:bc877baf-40ac-55ca-895a-b648c70ef152", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ], "bom-ref": "urn:uuid:f0279301-b22a-5145-8568-ed35728dcb58", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.11-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.11-tuxcare.6" } ] }