{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:54a7cf40-30dc-5fb6-a993-a2a4df2ac264", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11", "version": "5.3.29-tuxcare.11", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8cc9bd1e-39c8-5953-81cd-9a91cad1c526", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:c2fcf22c-c4f2-5c12-a819-14aa97feb858", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:97d80488-27fc-5452-a3b6-429816a53802", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:828e230f-930a-5abd-8df4-53334c409242", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:de34ff7a-614e-57c4-8400-b6536fec3f00", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:18d56e0b-f0dc-534b-87c8-ccf6f27e534d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2bbd3b3b-8077-5f6b-a63a-b3e754108fe5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:9d96d6d6-294f-52ec-b4da-26962723eac7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:287501c7-c4c7-5ec5-a9d7-2d8449c70e69", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:65485f7e-f480-515d-b409-56f9bc437eb1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:71c01cc4-e104-50ba-9392-2546ee7d5264", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41234", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:f6aa1cab-1a38-5254-9eab-5820eb947bd6", "analysis": { "state": "false_positive", "detail": "Vulnerability CVE-2025-41234 is a false positive for org.springframework:spring-expression 5.3.29-tuxcare.11." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:da64144b-2b5b-5b7e-ac6f-da62daf5802e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:bf677139-4a5d-57ee-892e-34fcd665f8c1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:403e4477-06ea-5957-8097-9194aae27032", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3c397381-5e8b-56f4-9996-9c1d01c07a84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7c7e73fc-c861-5389-9440-af97983c8810", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:93d8af65-ff95-5ada-a0cf-5a1178cfefa9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:daba3fe2-267f-5d13-84c5-085d0adb62e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ccaa6d0c-97a8-598f-a69d-e0d75d5e8271", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1806bcc2-fe59-5be9-8549-f0c24c75cd75", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2674d01b-e33b-5320-afb0-e5b110ed54c7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:16d1ca93-2fd9-5357-974e-db4d77c86356", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.29-tuxcare.11 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.29-tuxcare.4) already contains the complete fix for CVE-2026-41840. The fix was applied on 2026-05-19 as part of a TuxCare backport for CVE-2026-22740 (commit bc0026ae70c), which addresses the same multipart request DoS vulnerability with identical code changes.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8c0ba194-1d7d-527a-b3a1-a38f67ef81de", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fadc2c53-6707-5a5e-bd16-3419a3c5d215", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ef824f26-4f4b-5e07-aa34-ef0507a99e0d", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4c50821e-17b4-560e-bf34-1cf4adf68b2e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:97f04227-70fd-5f3f-8b8f-189675333842", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8c45eaed-3e0e-5837-91e0-a5e4db1de5ff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:76966701-8941-518c-8f0d-299d400799b5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:8cfae27c-ee38-5554-b3be-1aebb30c9ef1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:746674ef-e017-5c02-829a-ed82e485f8ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:efd63241-83fd-55f1-8ec2-85fe1b3162c5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7da3219c-f1a7-505e-99d5-b2b7a9eee399", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:3257f51a-2338-5e70-8225-099b273a0a8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:4d4ef208-f774-53ae-b27f-ed58f1024c13", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:d45ccccc-f996-55c1-959f-1eefdafbc5b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41854 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:76d7f30d-77df-5788-b25f-46a5727e185e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:7d742a38-791d-5a51-bbb1-8afc2a1d3437", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:631018d9-cfac-5bb7-857b-dccc2cd6fc83", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:30f1df55-f9fe-55a6-b470-5e55fec7379e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:42892b03-a816-530d-8ab2-42dee9d9f129", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:b175c951-35c8-5360-ad0d-54dd6c0018d6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:1f1556b7-1ece-515a-a061-667f8edde518", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fbe88755-3a4d-5457-aac2-57267ba18936", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:ec1766d0-4d76-59a3-95ee-fbf547920573", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:2e61c43a-de9a-56ad-8155-a8fc5f3e4fa1", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:0f9ebd97-5f8e-5861-812e-c02e456a9657", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:56684757-b0d8-5403-a24a-739175d89aea", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:fe2bc234-213f-52c0-b87a-99b010514d07", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ], "bom-ref": "urn:uuid:82c92b1c-59d3-5840-9d48-1e2cd73555ae", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.29-tuxcare.11 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.11" } ] }