{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:06868f2b-dc15-524f-ad6e-3e4716078eaa", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9", "version": "4.3.30.RELEASE-tuxcare.9", "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2016-1000027", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:6453954b-e88c-5f61-ba21-862dad84c1bf", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2016-1000027 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression and will not be fixed. It is not a patchable flaw but an inherent risk of Java serialization. It is recommended not exposing HTTP Invoker endpoints to untrusted clients; if such exposure is absent, no further action is required", "response": [ "will_not_fix" ] } }, { "id": "CVE-2020-5397", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:d9ca1660-3a33-5824-a50c-010fb75568b8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2020-5397 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2020-5421", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:71ea8d1f-433d-5a30-bc96-5d0f0bf8d232", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2020-5421 does not affect version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression. Version 4.3.30.RELEASE is not affected by CVE-2020-5421: the security fix is already present in the target branch. Momus prerequisite check: \"Patches already applied: 6327c60912cd80120040c8c16c3731d8bf6c19f6\". No backport needed." } }, { "id": "CVE-2021-22060", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:3d0b187f-ce9a-5ad2-895e-c4e30364f12c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2021-22060 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2021-22096", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:62337f98-7721-54eb-ad12-290009d017d8", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22096 does not affect version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression. CVE-2021-22096 fix already exists in commit 4895b739b3e5fea63ecb01ac867c136add560cf6", "justification": "code_not_present" } }, { "id": "CVE-2021-22118", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:37962f77-ee37-54db-944a-4fc1d9874a66", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2021-22118 does not affect version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression. Version 4.3.30.RELEASE is not vulnerable. Summary: Target repository is Spring Framework 4.3.30.RELEASE-tuxcare.2, which predates the introduction of WebFlux. The vulnerable code (reactive multipart handling with predictable temp directories) does not exist in this version. CVE-2021-22118 specifically affects WebFlux applications in Spring Framework 5.2.x prior to 5.2.15 and 5.3.x prior to 5.3.7. WebFlux was introduced in Spring Framework 5.0, and the vulnerable multipart han [terminalized not_affected from patch_application_manual/not_vulnerable]", "justification": "code_not_present" } }, { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:573d9eb4-a11f-5f48-84c4-2d441f0413e4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22950 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22965", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:afcda9bc-2ee4-560a-a47d-f279c8114e24", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22965 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22968", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:aa117622-6bba-5a75-928c-8ad214ccaf77", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22968 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22970", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:906ee8f0-02ea-5669-a971-a4d8dcc8e6c2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22970 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2022-22971", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:dec7a91d-e76d-5de3-8085-0dac388dcfff", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2022-22971 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:81930117-e95d-5484-86cc-c3ab78bb62a5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20861 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:244bc820-1e87-50cb-870a-d1a813787df6", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2023-20863 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22243", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:92cea43c-b9b2-5c5b-a774-1710aebf9cc9", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22243 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22259", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:d30e66fa-ae20-5a0d-a0a3-df4996aaa32c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22259 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-22262", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:7d086ee3-9a5e-5f11-923c-ce3371b14b3d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-22262 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:38c7ef77-f709-5fe3-9a52-885ed3829481", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38809", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:7ef4e7eb-80e6-586c-8c26-da87953cda34", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38809 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38819", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:0b0888a8-4d7a-5ab8-a751-91b6c3af71b2", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38819 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38820", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:a0584c17-93c0-5d92-b1de-95ac6afa2593", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38820 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2024-38828", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:edb8e40d-ea6e-51a6-9ab4-e67ca92bce6f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38828 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2025-22233", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:1ba738b9-ecb7-5256-89c4-dc81d0e16335", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-22233 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41242", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:752651b0-2f40-53da-bc27-407712e8d606", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41242 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41249", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:3c94c519-7530-5499-bacf-e5b3ba1b83f4", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41249 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2025-41254", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:aedf0823-5708-5c59-8145-63beb64ce200", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2025-41254 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22735", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:e8960966-7c5c-5b6c-a7b2-23285e84d77b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22735 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22737", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:38a0d930-0302-5a11-8901-bf393a0f5017", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-22737 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22740", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:e2f3737f-87b9-5f0a-a4ac-c3c72ce64edd", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-22740 does not affect version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression. CVE-2026-22740 is a WebFlux-specific vulnerability (reactive multipart temp-file cleanup in org.springframework.http.codec.multipart.MultipartHttpMessageReader / PartGenerator). Spring Framework 4.3.30.RELEASE predates WebFlux entirely - the org.springframework.http.codec package does not exist in this version, and there is no reactive multipart code path. Per NVD, affected versions are 5.3.x, 6.1.x, 6.2.x, 7.0.x only; Spring 4.x is not in the affected range.", "justification": "code_not_present" } }, { "id": "CVE-2026-22741", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:cd5289d8-2187-5719-ae7c-851c52e52151", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22741 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-22745", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:f51d3bf8-c259-5abb-811f-c9e7412d7e3c", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-22745 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41838", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:5896ea21-c9f3-5ff3-8544-56c1ea0cdd05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41838 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41841", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:7e8d65f3-99c5-5cff-a9d7-44947f691a1c", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41841 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41842", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:ec2d5fd4-2580-5ec9-8e38-c5291742403b", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41842 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41843", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:231b8bf2-a695-5bd2-9ea4-059592f55248", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41843 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41844", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:6ca96862-3518-5bb6-83a4-af8e849fa5f5", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41844 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41845", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:70131285-2faf-58f2-a67f-b16b7b513786", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41845 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41846", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:98e0af4b-f59c-507e-8e5b-61594d4e088f", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41846 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41848", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:48a1db39-677f-532c-bd56-1a4cee56915e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41848 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:65947a75-d374-5471-b18c-7a0d163cbb20", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:4d7c3517-0acc-50e3-aa2b-d51c92482911", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:aa652a5e-add3-5c13-92b0-0dca66490b3e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41851 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:64d82899-ddce-5683-b672-b510ea3c8c05", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41853", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:e9f44017-a211-5dd9-9906-5120ba1a7d86", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2026-41853 does not affect version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression. not_affected \u2014 Spring Framework 4.3.30 is not affected by CVE-2026-41853. This version predates Spring WebFlux (introduced in 5.0) and lacks the vulnerable component DefaultServerWebExchange.java. The vulnerability mechanism - Spring Framework's message reader selection based on wildcard Content-Type headers - does not exist in this servlet-based Spring MVC architecture.", "justification": "code_not_present" } }, { "id": "CVE-2026-41854", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:e8769ed8-9215-5dcc-8ec3-2d9e80e68311", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41854 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41855", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:11457f2f-0cce-568c-847a-4e14af93a948", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41855 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47884", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:e5070cb5-2da4-5f19-b172-ce6ac136d684", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47884 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:29b2f9de-9327-5255-86f1-787184d62310", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47886 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47887", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:279029e9-be64-572d-ae66-53277bdc22ad", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-47887 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59280", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:574d1b42-b85e-5fa6-89b6-1b0da7944f9d", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59280 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59281", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:08651448-7258-5ac7-b33c-9a946e51709a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59281 is fixed in version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59282", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:f9407c0d-41e6-5f87-b031-1a83371c13f4", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59282 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:2dc4edfb-d469-58ca-b1a7-0b763c5a5d30", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59283 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59314", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ], "bom-ref": "urn:uuid:4f998c09-9456-5992-8d1d-5727f242b6c8", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-59314 affects version 4.3.30.RELEASE-tuxcare.9 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@4.3.30.RELEASE-tuxcare.9" } ] }