{
  "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json",
  "bomFormat": "CycloneDX",
  "specVersion": "1.6",
  "serialNumber": "urn:uuid:8419d6a7-a880-55c9-9900-54572470940d",
  "version": 1,
  "metadata": {
    "supplier": {
      "name": "TuxCare",
      "url": [
        "https://tuxcare.com"
      ]
    }
  },
  "components": [
    {
      "name": "spring-expression",
      "purl": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4",
      "type": "library",
      "group": "org.springframework",
      "bom-ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4",
      "version": "4.0.0.RELEASE-tuxcare.4",
      "pedigree": {
        "ancestors": [
          {
            "name": "spring-expression",
            "purl": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE",
            "type": "library",
            "group": "org.springframework",
            "version": "4.0.0.RELEASE"
          }
        ]
      },
      "supplier": {
        "url": [
          "https://tuxcare.com"
        ],
        "name": "TuxCare"
      }
    }
  ],
  "vulnerabilities": [
    {
      "id": "CVE-2022-22950",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:c39fbf6d-e108-50df-b497-d47d97904962",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20861",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:a170e398-bd24-5851-9b60-fe3221c1421e",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2023-20863",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:e87b7a07-9f6b-5db5-a496-479fc582c50a",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2024-38808",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ee8380a6-cd4e-59a3-a5ea-f5c4657f4e38",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41849",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:b91c2cf2-67b5-5d18-b850-eaf31423ced4",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-41850",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:ef2cd88a-1c4b-5bfa-be06-f0255c012cf8",
      "analysis": {
        "state": "exploitable",
        "detail": "Vulnerability CVE-2026-41850 affects version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression, and is fixed in 4.0.0.RELEASE-tuxcare.5."
      }
    },
    {
      "id": "CVE-2026-41851",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:8a016fc7-d825-52b1-8efd-6d889efdeb38",
      "analysis": {
        "state": "not_affected",
        "detail": "Vulnerability CVE-2026-41851 does not affect version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.0.0.RELEASE does not contain the vulnerability pattern described in CVE-2026-41851. The target version predates the introduction of pattern caching in SpEL's OperatorMatches (added January 2015), so the unbounded cache growth mechanism cannot occur. While the affected versions listed in the CVE start at 5.3.0, the vulnerability pattern itself (unbounded ConcurrentHashMap cach...",
        "justification": "code_not_present"
      }
    },
    {
      "id": "CVE-2026-41852",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:6f8e3e83-3c49-5dec-b60b-a374c277ed48",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-47886",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:24abea70-06ff-564c-990e-cc0464aca947",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-47886 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    },
    {
      "id": "CVE-2026-59283",
      "affects": [
        {
          "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
        }
      ],
      "bom-ref": "urn:uuid:35224d0c-b71c-5b29-b069-85cf529f9303",
      "analysis": {
        "state": "resolved",
        "detail": "Vulnerability CVE-2026-59283 is fixed in version 4.0.0.RELEASE-tuxcare.4 of org.springframework:spring-expression."
      }
    }
  ],
  "dependencies": [
    {
      "ref": "pkg:maven/org.springframework/spring-expression@4.0.0.RELEASE-tuxcare.4"
    }
  ]
}