{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:0608daab-be6a-5453-b581-977cd357ced4", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12", "version": "5.3.37-tuxcare.12", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:4fc1771c-7975-50d1-92b4-854929210f63", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 5.3.37-tuxcare.12 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dd8544ec-5465-5ea3-b2ca-2ab3e2d354ba", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8de07f5a-81c3-58c0-89fa-be9b60b10038", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38816", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:711e43c5-354b-50a1-9eb5-620f667c5086", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38816 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:39644e82-597f-5f18-8ed4-4d916cf834f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:77540560-5fcb-5f3f-835b-56af5b7f4fa3", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:22b4427c-99a8-5a26-b7e1-c04bbab55f3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:9195b519-41a4-541d-aace-a17463fc2d34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:6b7b94c3-75ce-5f4d-bbe0-45ed93925bf2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:199a41bb-831a-5b77-ad8f-538e7b46c9be", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c0effd4f-519e-592f-8fb4-a60c981abd07", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2025-41254 affects version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:dfaaee3e-3f8b-544a-a13e-2b870ebd377f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22735 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0fc21ee6-717d-5f6b-ad04-fb50b3e3b2e0", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22737 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2844ec99-47ee-53dd-8a37-ec9ddb78f0f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22740 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:0db7261c-d1bf-556c-b6c8-13c5a7ffbd3a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:7bd92337-d6b6-5c99-abfa-a938b8721a4c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:24defd0c-eea0-5e6d-82fe-8c2f14f4653f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41839", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:63a97f5e-a81f-5e4d-8085-238c4bc6b133", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41839 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41840", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2d8a8f1d-5b2c-521e-90c5-e5306e109dd9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41840 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-expression. already_fixed \u2014 The target repository (Spring Framework 5.3.37-tuxcare.6) already contains both fixes for CVE-2026-41840. The fixes were backported on June 8, 2026 via commit 648b33d0a3 as part of CVE-2026-22740 remediation, which addresses the same multipart memory leak vulnerability.", "justification": "code_not_present" } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:57b2d11b-178c-52ab-9135-ac9109fa9781", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41841 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:50ef027c-e688-5260-9a4a-be4a03253732", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41842 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:1e5827bf-5074-565a-bdbd-2a01b82fc522", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:20b7fc95-f439-5269-ae2e-c10bc6500c8b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ca4782e7-f3ad-5b6d-a9de-62fc0d5c524e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:66d7a2dc-6a94-578a-a21f-3de6785d2efc", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41847", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a5143238-5367-5acc-8c56-2b5e4a0f1a24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41847 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:13270e3f-6bbd-508e-8f30-8410115ebc84", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41848 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:ebfa672a-ad1b-5b04-acf0-bb74197b7573", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41849 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-expression. Already patched: all patch commits for CVE-2026-41849 already present in target branch (momus prerequisite AllPatchCommitsAlreadyInTarget).", "justification": "code_not_present" } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2a605829-4498-5395-b32a-a4869c21a637", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d1d73087-14cc-51af-a324-e15f0af104db", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c3755a7c-2199-5837-93f2-94665e7f880f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:352ea619-f800-5e23-bab9-1d4baefd6602", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41853 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c40cacac-329b-512b-b744-574f57c9b6c1", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41854 does not affect version 5.3.37-tuxcare.12 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 5.3.37 is NOT affected by CVE-2026-41854. The vulnerability exists in RfcUriParser (introduced in versions 6.2.x and 7.0.x) which incorrectly accepts malformed IPv6 URIs like `https://[::1]resource`. Version 5.3.37 uses regex-based parsing that correctly identifies the host component, preventing the SSRF outcome even when accepting the malformed format. The architectural differ...", "justification": "code_not_reachable" } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:2d2f2cc6-191d-5dbe-bb2f-b00357bd3a9f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:343afb15-b1b7-5d7f-96d6-2e4dc1db5ccd", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:31d0a309-0ac1-5285-b1ca-8c4e19a458aa", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:c0b67bc7-715d-5d39-ae20-afd7c21ec10e", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47887 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47888", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f369601a-6615-5a3b-9ffc-59edd7338c39", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47888 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47891", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:869632c1-5fa8-5a8e-9b8c-203f598015d8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47891 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47892", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:8d2c63e9-122b-5c7e-84c2-53a37ae6fe14", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47892 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47893", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:502f4614-ffe4-5e00-8c95-0046f1c2748b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47893 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d60d9b9e-c6bc-59a1-99f2-80e401535b01", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:89afcf1b-5d33-5703-b4d7-3020354d8658", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:a32ee615-6d83-57fd-b705-5c4fead86666", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59282 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:025da2e9-cebd-5975-9474-0f0683b658d7", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59313", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:f39fbd63-1fc0-5adf-bf3d-a3bf53d7fe8a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59313 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ], "bom-ref": "urn:uuid:d67d132a-41f8-5566-9879-488036b9c52b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59314 is fixed in version 5.3.37-tuxcare.12 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.37-tuxcare.12" } ] }