{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:a8c5fdc8-cdc1-55ae-a3d0-f5d0d77e553e", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12", "version": "5.3.29-tuxcare.12", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.29", "type": "library", "group": "org.springframework", "version": "5.3.29" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:3677e3b2-59e9-5ce5-903e-90d1fd24a8c9", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-expression. not_affected \u2014 Target Spring Framework 5.3.29 is not affected by CVE-2022-22950. The vulnerability (unbounded array allocation in SpEL expressions causing DoS via OutOfMemoryError) was fixed in upstream Spring Framework 5.3.17 by commit 83ac659158 (Sam Brannen, 2022-03-08). The fix adds MAX_ARRAY_ELEMENTS=256K validation before array allocation. This fix was already present in the upstream 5.3.29 release that...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:038ec595-d837-5b3e-8514-6de65959f608", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework 5.3.0-5.3.25 due to inefficient regex pattern caching in the SpEL matches operator causing DoS. Target version 5.3.29-tuxcare.12 includes the upstream fix (commit 430fc25acad2e85cbdddcd52b64481691f03ebd1 by Sam Brannen, March 2023) that moved the pattern cache from OperatorMatches instance level to InternalSpelExpressionParser level for sharing across all...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:26597487-680b-5e39-acb0-c3f7f3732c2d", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 5.3.29-tuxcare.12 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863: The target Spring Framework 5.3.29 is NOT affected. The fix limiting SpEL expression length to 10,000 characters was already present in the upstream 5.3.29 release. The vulnerable code pattern (unbounded expression parsing) is not present because the upstream Spring team (Sam Brannen) fixed it in versions 5.2.24+, 5.3.27+, and 6.0.8+. Target version 5.3.29 >= 5.3.27 and includes...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:83b459c6-6f95-55aa-9374-fb9fadec4488", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2024-38808 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:df959c64-9d5f-5783-9606-ae578b982b36", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41849 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:db19a7b8-9554-5f4a-b41a-8edd03aad0df", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:09368cdc-4f55-5706-8f52-f5daa378e715", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:6d110dc6-fd24-5676-b60d-73556b709869", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:4ae1929f-3a12-5bec-91de-27567c52177b", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ], "bom-ref": "urn:uuid:e11729b5-e446-529e-aecf-982c2ec0d894", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.29-tuxcare.12 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.29-tuxcare.12" } ] }