{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9ed86a18-8ce7-550a-b506-e06cdc8d5f10", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6", "version": "6.0.12-tuxcare.6", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.12", "type": "library", "group": "org.springframework", "version": "6.0.12" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2023-34053", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:74dce7b2-49d2-5178-904a-bb3be8b86209", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2023-34053 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:54a0171e-8ee6-51b3-9562-40af2e6a5154", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6afacd90-e592-50ca-b1be-2cbfbe3c3219", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22259 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4e786b6d-6e67-5823-9fcf-3a7c0620fe01", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-22262 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7636146f-1643-507f-b6b8-33da365b9ea1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:432e5cb0-5164-5bd8-a247-e52863b6c087", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1b361db7-ebf5-581b-a296-27da0e5a9db6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:016d9e52-91c8-54b8-a730-6812b71e8106", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38820 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:360e8e18-c103-5b8e-93d7-c4aae5654987", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-22233 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:235443b6-6c49-5da9-80c3-b596e4a77422", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bd7044da-b332-55c8-b461-6da4e8346fc1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0be9cc02-1c42-5bfc-b302-c20172773a03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d81f0aaf-dbd5-5ce5-89ca-5793141f875a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:384ade09-4630-51be-9dd4-d057f0d171ee", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b1b3c31c-f908-5c1f-ba86-0907e1a36c7f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:8ae48ae2-0dda-5660-9d65-ba5fb6bdc4d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:10b1846c-8316-51c6-aff9-3b2bc6505826", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:02262125-ea12-530c-ba3e-8141b5bffe23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:cb188227-fe56-519a-9a30-eee04141c6f8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2ebe22a5-64f9-5634-ac92-c4d18e1f1a17", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41839 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-expression. Current version of spring-framework is not affected by CVE-2026-41839 according to the vendor - https://spring.io/security/cve-2026-41839", "justification": "code_not_present" } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:db13f7c6-593c-57af-90be-80a8942ace9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:aabbcd4d-b71f-5108-a4b1-077ba1113369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:064f271a-15de-5109-af1d-af2c309db46c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:4e9afa26-589c-57ce-9f10-c96a6cdfefaf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:9765429f-17ab-5713-a56d-f60b21f45a17", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1823a183-21f6-5912-be56-3dd9efa4984e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3bbf70d1-5bcf-5c5b-90a6-6b45f4ab4525", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:1bf52157-d538-57e8-aea9-898b38a402f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:6d4be059-56c6-521e-a4f8-39caa7c7b687", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:23286f4b-1416-5314-a0a2-c6097138bf7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:e19695dd-b22c-50cc-80b4-6e92d784e745", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:bfbb5e17-c8c7-585a-b3c9-d26157075937", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:b369e692-5c8c-5f8d-83f8-5d0c8cc3f28a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:973ce4c4-fff4-5e1e-a945-dd7c11305ff3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:a2743d95-0414-5ccc-b106-d120fdfc656d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7d6f6335-599f-5195-a14b-eb86690c2588", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0a8b2a84-40b4-56ac-b857-0178e6901c3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3a1372d3-49f1-5b9e-9638-c3c620f8d7cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:65b22d74-9336-52ae-aab4-c3a506030576", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.12-tuxcare.6 of org.springframework:spring-expression. Spring Framework 6.0.12 is not affected by CVE-2026-47890. The vulnerability concerns SSE stream corruption when rendering view fragments, a feature introduced in version 6.2.0. Version 6.0.12 does not contain the Fragment class, FragmentsRendering infrastructure, or the vulnerable SSE fragment formatting code. The affected code paths (ViewResolutionResultHandler.escapeSseFragment and ResponseBodyEmitterReturnValueHandler.getFragmentContent) do not exist in this version. While 6.0.12 does support basic SSE via SseEmitter, it already implements correct line-ending escaping in its writeStringData method (handling \\r, \\n, and \\r\\n properly).", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:2e40e6e6-85d0-539d-884e-a581f95578cf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:054854a0-14a8-552b-89fa-07387f68b221", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:0399a638-7705-50bc-9aa6-af39bc04def4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5b3f0016-13af-58de-83f1-dac390835ca2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:11a8222b-e8d1-52d8-b251-2cc4c61b0fef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:7fe6001d-1d5e-573b-b1b8-2c0933d05c29", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:3481d61d-cc2d-5d2e-a60f-63eb6ceedaeb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:5e9e4f16-fb89-54f2-bc10-b5a0889a6456", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ], "bom-ref": "urn:uuid:d2b132ed-3c99-5b74-ae52-9a7f1879cf9b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.12-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.12-tuxcare.6" } ] }