{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:cbbb3b3a-e55e-5c12-abc2-44dd88f19e95",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-expression",
      "purl": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6",
      "version": "3.1.1.RELEASE-tuxcare.6",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-expression",
            "purl": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "3.1.1.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6751c976-5471-5fb5-b6f7-dc8f52aa510b",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22950 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:cfca6ddc-637d-510c-ac84-85a0ac1341c5",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20861 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:6cfdc993-c592-5e83-9b23-d5543c28ef28",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:84fbd62b-cb5e-58ce-a7e8-6f4a154eff69",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:7adbbbfd-4ccb-50d0-b620-30767ae0cf18",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:3b485197-8fb7-5f2a-a5c5-74bc5bc037c8",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41850 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:9165b85c-ea5e-54fd-b287-e99ee42f99f1",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41851 does not affect version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 3.1.1 is not affected by CVE-2026-41851. The vulnerability requires unbounded cache growth in SpEL regex pattern caching, but version 3.1.1 does not implement any pattern caching mechanism. Each regex pattern is compiled fresh on every evaluation. The pattern cache was introduced much later (in 2023 via CVE-2023-20861) as a performance optimization, and CVE-2026-41851 then iden...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:d6e2c50c-1f22-5bdc-8e6c-19ca84fb2c3f",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4070839a-cd0a-5bf9-ac9f-86b1e7fc55cd",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
        }
      ],
      "bom-ref": "urn:uuid:4b92ffc7-a2ec-538d-b268-ed80e511e47a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 3.1.1.RELEASE-tuxcare.6 of org.springframework:spring-expression."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@3.1.1.RELEASE-tuxcare.6"
    }
  ]
}