{ "$schema": "http://cyclonedx.org/schema/bom-1.6.schema.json", "bomFormat": "CycloneDX", "specVersion": "1.6", "serialNumber": "urn:uuid:3b90882d-f4d8-55fe-b461-d6436e1462b5", "version": 1, "metadata": { "supplier": { "name": "TuxCare", "url": [ "https://tuxcare.com" ] } }, "components": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3", "type": "library", "group": "org.springframework", "bom-ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3", "version": "5.3.32-tuxcare.3", "pedigree": { "ancestors": [ { "name": "spring-expression", "purl": "pkg:maven/org.springframework/spring-expression@5.3.32", "type": "library", "group": "org.springframework", "version": "5.3.32" } ] }, "supplier": { "url": [ "https://tuxcare.com" ], "name": "TuxCare" } } ], "vulnerabilities": [ { "id": "CVE-2022-22950", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:029961a8-7b86-5c41-bf7e-d034d57bd327", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2022-22950 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 Target version 5.3.32 is not affected by CVE-2022-22950. The vulnerability (DoS via unbounded array allocation in SpEL expressions) affects Spring Framework versions 5.3.0-5.3.16. The fix was introduced in upstream Spring Framework 5.3.17 (commit 83ac659 by Sam Brannen on March 8, 2022) which added MAX_ARRAY_ELEMENTS validation (256K element limit). Target version 5.3.32 inherited this fix from...", "justification": "code_not_present" } }, { "id": "CVE-2023-20861", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c290aa01-5a0b-54d6-9f30-f1effe5d65f6", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20861 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20861 affects Spring Framework 5.3.0-5.3.25 (DoS via excessive Pattern compilation in SpEL matches operator). The target version 5.3.32 is NOT AFFECTED because the upstream fix was already included in the 5.3.32 release. The fix introduces a shared pattern cache at the parser level to prevent redundant regex compilation. Both required components (OperatorMatches.java and InternalSpelEx...", "justification": "code_not_present" } }, { "id": "CVE-2023-20863", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:e9971a6c-26ac-5c33-b2b1-9ceba8baf9a0", "analysis": { "state": "not_affected", "detail": "Vulnerability CVE-2023-20863 does not affect version 5.3.32-tuxcare.3 of org.springframework:spring-expression. not_affected \u2014 CVE-2023-20863 is NOT present in Spring Framework 5.3.32. The vulnerability involves unbounded SpEL expression lengths causing DoS via resource exhaustion. The fix (expression length limit of 10,000 characters) was already present in the upstream Spring Framework 5.3.32 release that TuxCare onboarded. The defense is implemented in InternalSpelExpressionParser.checkExpressionLength() and is acti...", "justification": "code_not_present" } }, { "id": "CVE-2024-38808", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:216dad34-e7ad-588d-ad2a-30276aae053e", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2024-38808 affects version 5.3.32-tuxcare.3 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.4." } }, { "id": "CVE-2026-41849", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:3c67f5cd-965b-5de4-97aa-4d7b6c7a1c65", "analysis": { "state": "exploitable", "detail": "Vulnerability CVE-2026-41849 affects version 5.3.32-tuxcare.3 of org.springframework:spring-expression, and is fixed in 5.3.32-tuxcare.6." } }, { "id": "CVE-2026-41850", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:b15dcde7-5268-5ec9-86d4-fbb696414644", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41850 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41851", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:d2fe79d1-c945-5390-9ba0-ab25f6813a73", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41851 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-expression." } }, { "id": "CVE-2026-41852", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:c8dfe843-fb83-5dd0-9172-5658b81e390a", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-41852 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-expression." } }, { "id": "CVE-2026-47886", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:2373670a-be9e-528e-9844-00d991c58855", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-47886 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-expression." } }, { "id": "CVE-2026-59283", "affects": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ], "bom-ref": "urn:uuid:9da9822b-cdfb-5db0-80c1-fb04ffdf77a8", "analysis": { "state": "resolved", "detail": "Vulnerability CVE-2026-59283 is fixed in version 5.3.32-tuxcare.3 of org.springframework:spring-expression." } } ], "dependencies": [ { "ref": "pkg:maven/org.springframework/spring-expression@5.3.32-tuxcare.3" } ] }