{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:82cf089c-0431-54c1-834c-fba6c97cb849", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6", "version": "6.1.19-tuxcare.6", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cf2f8894-2fb3-5161-8a96-c52a7a459b7a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:f6c0314f-7ee7-5b42-ae99-502ca86316f0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41234 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c70a0bc3-97d6-5bbb-8555-18bdb6f1fcac", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:efbb8d94-d506-5ec7-8a5b-92053ea1a97f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:aacb60b7-0e87-505e-b7dc-7a24d19ae24c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a26fd12e-74fe-555e-b677-80422f8fc769", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:9c91d895-38bf-5aac-9aa5-6b6082664100", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:31f6b706-e323-5524-a3d9-b8c897087bd3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fca8667d-a978-52af-9bdf-fa6996eff1ce", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:1696ba14-4277-54f8-a248-76c717d51610", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:936bde31-7fcd-56e4-990a-d12c5ee96577", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:7dde1ff2-fa71-573a-a241-627c1594c7a1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d682596a-44af-5ed2-95fd-094274c6d403", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41840 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:957f8fa2-b54e-562a-bc83-89aada4712d2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:fe034cd9-c21d-50b7-8620-e07a483ea5d9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:5cb0a94c-926e-59a4-b8d0-a5663f1bf56c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41843 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2a5eb83a-8728-572d-a509-2a79b07a7d18", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:527f4b07-486e-5ba3-9cf1-77a5c9cc616d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:05590a20-0274-5a23-bddb-36cc352a36a0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:a9e7691d-ceef-5a5b-8bed-bb9474f5822f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:11381fd4-b262-517b-aa7e-38ab859bc704", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:328d5f73-faa2-5ff3-9415-5fecad55c567", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2e0806c7-ba52-5e63-b63e-9c7d46df2150", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:be53d718-9fcc-5855-bbb7-8b6e9d2e8b2c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:63c557d0-9085-5a89-80ea-65f1edd71edc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b7ba0391-a86c-5241-9d01-2d7ebe46da83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:d9cf70a7-22ea-59bc-9287-5d4f2a88facf", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47885", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:b42a6b52-69bc-53a8-87be-423302d6e2a6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47885 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:3b8a14f0-3360-51b4-9921-7738a2badbda", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2d36e4ca-f505-598c-a95d-840c8fe2e82e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0bccbaba-e2ee-53be-841e-fe495fbe047f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47890", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2cdee8f9-9553-5e93-958c-651c010d6fc5", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-47890 does not affect version 6.1.19-tuxcare.6 of org.springframework:spring-expression. Spring Framework 6.1.19 is not affected by CVE-2026-47890. The vulnerability targets SSE (Server-Sent Events) Fragment rendering, a feature introduced in version 6.2.0 (August 2024). Version 6.1.19 predates this feature entirely. The CVE explicitly lists affected versions as 6.2.0-6.2.19 and 7.0.0-7.0.8, confirming 6.1.x is outside the affected range. The vulnerable code paths (ViewResolutionResultHandler fragment formatting and ResponseBodyEmitterReturnValueHandler getFragmentContent method) do not exist in the target codebase.", "justification": "code_not_present" } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:2536bd92-170c-5c0c-bba9-bdb85ff303e3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:c2e8b569-8068-51fd-ad8b-427b9bd169d1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:915ad8e1-3b6c-5b0b-b15c-7828d380a515", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:cd3a90f4-1280-52a8-ad2a-775c97f26f8d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:0f86642f-bef8-5462-8ca8-92a00b9fd389", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:6dd49c43-6c5e-5ec0-b0a4-4c933e8eda6c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:749d8e54-34d6-560c-a155-c00c395c74ab", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:8246950f-30fe-5326-b5e3-64b03af75ea2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ], "bom-ref": "urn:uuid:55f2260b-ad30-5b1d-9594-e0fbb760b901", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 6.1.19-tuxcare.6 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@6.1.19-tuxcare.6" } ] }