{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:f0317b58-5380-5491-a63e-9ef64450204d", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12", "version": "6.0.23-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.0.23", "type": "library", "group": "org.springframework", "version": "6.0.23" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:aae3c0b1-10ed-54e2-9bfa-30c11dd0e57a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:350534c5-f787-51c1-99b9-054e420342ad", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:99e750b6-5675-5dcf-b51d-1ef6f5c47a99", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:82041e9c-fb18-5411-9e1b-4f5f985fe288", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7e0d9a11-8f45-5859-9087-1639e448ee03", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b62c6edb-befc-51f0-b949-876404406d15", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f56d1774-d3e6-5408-a426-91b8dd03387c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a04e1063-c89a-572e-86d1-dec34243478a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b5fe5120-d1e3-5875-8084-4bc57f6e302e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7bebaf18-5cc3-5349-95e8-8a93260bcfbe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:41d19837-6101-58a2-88f4-19d1cfcb1dd6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:08e854e2-d39f-50c2-82a6-c39c0d637369", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:632be03b-a26d-5ee5-8d39-e7877bf438a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0666c115-b3e1-5f44-8ff0-e73c4571ac34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f4907136-ff0d-5094-9104-e1fd4832c6cc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:99d76d01-fd70-5037-86bd-9f7cb37b9058", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0a8338e1-02ca-5469-aa13-48ebd7c6297d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:4673001e-1762-5d43-b5e6-2ec98c29add7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:27f93cef-1209-5d78-bf35-2c81f8088b32", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a8c5da6f-ed37-5f52-a0aa-d0b066ae0266", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b8e8889d-b930-5d77-8f1d-08644a78af5f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a4bb804b-9849-5f03-a754-831e841b4280", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:d022767d-dd9d-5708-a33c-bcaa583806d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:162ed2df-ab10-52bc-9b75-edc0b8df6180", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a6e8ad2c-95e8-56e1-bf50-f25bb1cd08f6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:54cac9da-d56f-50d7-8308-aa8fa607a3ef", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:e23b79d0-bb33-52f5-bfff-cb7d54b95ed1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:5c260954-e74b-5bd2-b8fc-1584be7f910a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:ccb62641-f04b-5c64-ac18-c7a3209f8080", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:3c39fb56-8f21-5fa9-a33d-d80034d37d23", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:0054464a-484f-51e2-adc5-d65f45599db3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:08d7b710-3c76-5a78-ac22-e1fddc752337", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:f5105456-79e6-5884-9bfd-b0cd5df3d42a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:245e71ab-26ab-5503-b0d0-fd30f5c354c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.0.23-tuxcare.12 of org.springframework:spring-expression. Spring Framework 6.0.23 is not affected by CVE-2026-47890. The vulnerability is specific to the Fragment rendering feature for Server-Sent Events, which was introduced in Spring Framework 6.2.0 (commit 622c1b9e8c, August 2024). This feature does not exist in version 6.0.23, therefore the vulnerable code pattern cannot be present.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:86c91e13-7d17-5463-a6ba-cc0b1956195e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:85235fdf-af49-57f1-adb4-aed569e779c4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:bbf05a8b-368a-539d-b9d2-412389fb27fe", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:b68f24cf-de98-50f2-a70e-88cb130f265f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:a5c9620f-40ee-57d4-a0e2-1f1b1d75a6d3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:371b1dfa-97f3-533f-be58-d989f47a4b74", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:c35d8c02-b562-5a9a-8160-9ef1945a9009", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:6c6d9ca4-e87a-567d-a1e9-463ff4e84fe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ], "bom-ref": "urn:uuid:7f5896f6-997c-5f66-a0fc-931d4fb4917f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.0.23-tuxcare.12 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.0.23-tuxcare.12" } ] }