{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:9dbbe113-3951-5144-9bcb-f6ca9ad71b38", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11", "version": "6.0.16-tuxcare.11", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.16", "type": "library", "group": "org.springframework", "version": "6.0.16" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d740b007-ab56-5957-96c4-c77a22fb31ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7631895d-9cc2-59d8-9dc2-68ae4d1450bf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:a1c03aa5-4282-5b1c-9490-4c340736b08a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:08e2736f-d40f-5d6e-b23c-400b8c15112a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:22b106c9-3bb5-51a4-808b-f7f181d6a159", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:c57ff3b0-94a1-5fbc-8a09-fdf0c8bb662a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:543f89c2-5947-5d8f-aa9d-344e36b7b699", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fccb0db5-c77e-51c0-bb6b-5da7953fd3aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d3b3ec9d-5baa-56de-a539-c0f3b08c2396", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bb51164b-7f28-5004-84f3-e50f5a612fbb", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:0febd7f9-d239-50c6-87ca-8b10ae71d3ca", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fdcca9fe-cd5a-5c8d-8bb7-20855dfb2080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:98ceb8da-dc06-5d9f-bbd1-806540a0e8b9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:73625f32-bfa9-59c3-86ff-b5552a5d0e31", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3c3c140a-2901-50ad-8175-4ef331d0c947", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:2c6d10ac-7efe-5e8e-ba25-0fc5f0bd630b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e67852f8-ab7c-5abc-91a9-4b20adb60723", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:fd04bedb-4ee9-5d80-a25a-aa9bda167c4a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8d5276c2-4d78-537e-ae00-a4c5757f9824", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:904c9377-9ae4-5d8b-94ef-b7d2fb8cffc0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:5ca1acb5-3c9c-55e7-a41f-f4abf94e4920", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d6e3ef0d-ba73-5325-9fbd-990eed9f39a7", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:de649d4d-6436-547d-9396-0c2470746f51", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b6919d84-967e-57c2-8006-a5c714fbc38d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:da465ce1-9cd5-599d-be18-61da99812854", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b25546a0-d8c0-5f4f-b663-2300e080540f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:81facd9e-295b-5ce8-96b1-a87495c9951f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:19c7a791-c707-598c-8634-85a6f7edef40", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d3ed9e78-dfa0-5059-991d-0c200f158d00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ef5fa696-984c-537f-89c2-4eecd9bd0368", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:8f5133f8-b09d-5ba2-9dd8-7ae60a8fcf98", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:00dbea48-442b-5896-a567-1373a7e506e9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:b709e123-0d5e-5d71-be96-666b04b776fd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:533fb069-bfc3-597a-9ffe-27d326b8af8e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4a6196f0-778d-53b6-80d7-5c15c47ad09f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:e1419681-686f-5cc5-8f77-2b51bcd66691", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:36e04cd9-ca25-56bb-a3a6-96dfbd489b09", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d7b54194-23f4-511b-b5fc-bb194afa103b", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.16-tuxcare.11 of org.springframework:spring-expression. Spring Framework 6.0.16 is NOT AFFECTED by CVE-2026-47890. The vulnerability exists only in the SSE view fragments feature introduced in version 6.2.0 (August 2024). Version 6.0.16 predates this feature by over a year and does not contain any Fragment rendering code, the vulnerable `getFragmentContent()` method, or the flawed `text.replace(\"\\n\", \"\\ndata:\")` pattern. The existing SseEmitter class in 6.0.16 already implements proper CRLF escaping in its `writeStringData()` method (lines 245-268 of SseEmitter.java), using the same character-by-character logic that the patch adds to the Fragment code in 6.2.x. The CVE's affected version range (6.2.0-6.2.19, 7.0.0-7.0.8) accurately excludes 6.0.x versions.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:7e49c85a-7b76-5ec7-9db6-7988f9dfb09c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:4795eea1-dde0-5c7f-87dc-fc865105fe0e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:dc6ef388-b9a0-5608-8aeb-b435636d8075", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:ca44a987-335a-5875-a5fd-f3fed0f86a53", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:d35f7cb6-6dd8-5b43-8650-17aefc3713d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:37068146-7271-5da2-8065-d136d005ae49", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:bc414368-1a42-5275-b355-39b1627dcc2f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:abbb7c71-600d-57b4-9efc-1b9006452b94", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ], "bom-ref": "urn:uuid:3fbd4963-7444-5319-a48f-67c406df6bce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.16-tuxcare.11 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.16-tuxcare.11" } ] }